blustealer | e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3

Analysis

max time kernel
46s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-09-2022 16:37

Target

e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe
Size

1.3MB
MD5

4dd8e80743fadc1b4be934092932f3a6
SHA1

811b5d1a3bf8a898f8e75cf2e06431b8fa66d441
SHA256

e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3
SHA512

f79052a12f1e30b5ed3d9497924fd1a7e05a38206a8beb175b128cdf7f2a7331b54cc5a9ebe93d18a5d73c72b7ba11942af10c38ed2868a0a89ac785bfc69675
SSDEEP

24576:ptPjrUEaA/KOenctXOU0EOq711yRQ6sBBtUix4OghAbCUB:p5jrUEaAZeVZw7156sBAI/eAPB

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1912 set thread context of 1272	1912	e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1912	e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe
1912	e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1912	e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1272	e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1272	1912	e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe	28
PID 1912 wrote to memory of 1272	1912	e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe	28
PID 1912 wrote to memory of 1272	1912	e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe	28
PID 1912 wrote to memory of 1272	1912	e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe	28
PID 1912 wrote to memory of 1272	1912	e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe	28
PID 1912 wrote to memory of 1272	1912	e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe	28
PID 1912 wrote to memory of 1272	1912	e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe	28
PID 1912 wrote to memory of 1272	1912	e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe	28
PID 1912 wrote to memory of 1272	1912	e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe	28

C:\Users\Admin\AppData\Local\Temp\e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe
"C:\Users\Admin\AppData\Local\Temp\e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Users\Admin\AppData\Local\Temp\e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe
  "C:\Users\Admin\AppData\Local\Temp\e8c68954927883269ab561d217148fdf643b526cf7b8869c90ec177376086fe3.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1272

memory/1272-57-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1272-58-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1272-60-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1272-62-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1272-65-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1272-69-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1272-70-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1912-54-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1912-55-0x0000000074AD0000-0x000000007507B000-memory.dmp

Filesize
5.7MB

Download
memory/1912-56-0x0000000074AD0000-0x000000007507B000-memory.dmp

Filesize
5.7MB

Download
memory/1912-68-0x0000000074AD0000-0x000000007507B000-memory.dmp

Filesize
5.7MB

Download