blustealer | 70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45

General

Target

SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe
Size

1.4MB
MD5

ed164e11ea8f141236b6196dac5bd879
SHA1

d06277b3d82a10ffeced147870a1c7cc65947ae0
SHA256

70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45
SHA512

996973f75d75a179091211a3d86f91138565add95f7d34089d9610fcfc4ba228c91d1fc830f2f49146db4752270c51702caaf4513fe6cd15df5f5a84427bdd55
SSDEEP

24576:7fdsbW0F+Rhk0JgdIpsiwO/QGoWP2qQF+2:O6k0i2qAQGoie

Score

10^/10

blustealer stealer

Malware Config

Extracted

Family

blustealer

Credentials

Protocol: smtp
Host:
mail.aakarveneers.com
Port:
587
Username:
[email protected]
Password:
milin@1982

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1080 set thread context of 2168	1080	SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2236	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2168	SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 2236	1080	SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe	30
PID 1080 wrote to memory of 2236	1080	SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe	30
PID 1080 wrote to memory of 2236	1080	SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe	30
PID 1080 wrote to memory of 2236	1080	SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe	30
PID 1080 wrote to memory of 2168	1080	SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe	32
PID 1080 wrote to memory of 2168	1080	SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe	32
PID 1080 wrote to memory of 2168	1080	SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe	32
PID 1080 wrote to memory of 2168	1080	SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe	32
PID 1080 wrote to memory of 2168	1080	SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe	32
PID 1080 wrote to memory of 2168	1080	SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe	32
PID 1080 wrote to memory of 2168	1080	SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe	32
PID 1080 wrote to memory of 2168	1080	SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe	32
PID 1080 wrote to memory of 2168	1080	SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe	32

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YNkcJQK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6BFC.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2236
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-78-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download
memory/1080-54-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download
memory/1080-55-0x00000000072E0000-0x0000000007320000-memory.dmp

Filesize
256KB

Download
memory/1080-56-0x0000000000250000-0x000000000025C000-memory.dmp

Filesize
48KB

Download
memory/1080-57-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download
memory/1080-58-0x00000000072E0000-0x0000000007320000-memory.dmp

Filesize
256KB

Download
memory/1080-59-0x00000000085B0000-0x0000000008652000-memory.dmp

Filesize
648KB

Download
memory/1080-60-0x00000000048F0000-0x0000000004960000-memory.dmp

Filesize
448KB

Download
memory/1080-53-0x0000000000C30000-0x0000000000D94000-memory.dmp

Filesize
1.4MB

Download
memory/2168-66-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2168-69-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2168-71-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2168-73-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2168-75-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2168-68-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2168-79-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads