blustealer | 4677198e0721af982c01a7ffaafb2f29ae83ebaeb7a510d9d58ba260c74b1960

General

Target

70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe
Size

1.4MB
MD5

ed164e11ea8f141236b6196dac5bd879
SHA1

d06277b3d82a10ffeced147870a1c7cc65947ae0
SHA256

70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45
SHA512

996973f75d75a179091211a3d86f91138565add95f7d34089d9610fcfc4ba228c91d1fc830f2f49146db4752270c51702caaf4513fe6cd15df5f5a84427bdd55
SSDEEP

24576:7fdsbW0F+Rhk0JgdIpsiwO/QGoWP2qQF+2:O6k0i2qAQGoie

Score

10^/10

blustealer stealer

Malware Config

Extracted

Family

blustealer

Credentials

Protocol: smtp
Host:
mail.aakarveneers.com
Port:
587
Username:
[email protected]
Password:
milin@1982

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1184 set thread context of 3068	1184	70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2980	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3068	70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2980	1184	70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe	30
PID 1184 wrote to memory of 2980	1184	70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe	30
PID 1184 wrote to memory of 2980	1184	70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe	30
PID 1184 wrote to memory of 2980	1184	70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe	30
PID 1184 wrote to memory of 3068	1184	70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe	31
PID 1184 wrote to memory of 3068	1184	70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe	31
PID 1184 wrote to memory of 3068	1184	70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe	31
PID 1184 wrote to memory of 3068	1184	70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe	31
PID 1184 wrote to memory of 3068	1184	70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe	31
PID 1184 wrote to memory of 3068	1184	70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe	31
PID 1184 wrote to memory of 3068	1184	70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe	31
PID 1184 wrote to memory of 3068	1184	70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe	31
PID 1184 wrote to memory of 3068	1184	70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe	31

C:\Users\Admin\AppData\Local\Temp\70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe
"C:\Users\Admin\AppData\Local\Temp\70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YNkcJQK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1CA5.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2980
- C:\Users\Admin\AppData\Local\Temp\70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe
  "C:\Users\Admin\AppData\Local\Temp\70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-78-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/1184-54-0x0000000000090000-0x00000000001F4000-memory.dmp

Filesize
1.4MB

Download
memory/1184-56-0x0000000004510000-0x0000000004550000-memory.dmp

Filesize
256KB

Download
memory/1184-57-0x00000000003F0000-0x00000000003FC000-memory.dmp

Filesize
48KB

Download
memory/1184-58-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/1184-59-0x0000000004510000-0x0000000004550000-memory.dmp

Filesize
256KB

Download
memory/1184-60-0x000000000A320000-0x000000000A3C2000-memory.dmp

Filesize
648KB

Download
memory/1184-61-0x000000000A3C0000-0x000000000A430000-memory.dmp

Filesize
448KB

Download
memory/1184-55-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/3068-67-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/3068-71-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/3068-73-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3068-75-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/3068-77-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/3068-69-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/3068-81-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads