blustealer | 731cea3715ba1107c3ed9333a556736dc6d710f22de531bc4cbcb9af9b1a2f0e

Analysis

max time kernel
97s
max time network
41s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-12-2023 02:59

Target

9ef9bddf86918a7458905a441643a8ad.exe
Size

1.3MB
MD5

9ef9bddf86918a7458905a441643a8ad
SHA1

416016254438b55e96f25a775ee53202fce790cf
SHA256

731cea3715ba1107c3ed9333a556736dc6d710f22de531bc4cbcb9af9b1a2f0e
SHA512

e44974106d2144238071957e0e9e3457f291e243febb71532e0b5ecae8dc759140d52950cd564e49b5f4c0f7c6987242ef176dba4664414eca0ce67735b1c625
SSDEEP

24576:fEpGAWfNaleWllK9Ua3IUhIMUB2CoHzvTzwsdksiYeOgPP6B:4jW8lzl0vIUhIM2GHEXYetP6B

Score

10^/10

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2648 set thread context of 2576	2648	9ef9bddf86918a7458905a441643a8ad.exe	29

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2648	9ef9bddf86918a7458905a441643a8ad.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2576	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2576	2648	9ef9bddf86918a7458905a441643a8ad.exe	29
PID 2648 wrote to memory of 2576	2648	9ef9bddf86918a7458905a441643a8ad.exe	29
PID 2648 wrote to memory of 2576	2648	9ef9bddf86918a7458905a441643a8ad.exe	29
PID 2648 wrote to memory of 2576	2648	9ef9bddf86918a7458905a441643a8ad.exe	29
PID 2648 wrote to memory of 2576	2648	9ef9bddf86918a7458905a441643a8ad.exe	29

C:\Users\Admin\AppData\Local\Temp\9ef9bddf86918a7458905a441643a8ad.exe
"C:\Users\Admin\AppData\Local\Temp\9ef9bddf86918a7458905a441643a8ad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\9ef9bddf86918a7458905a441643a8ad.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2576

memory/2576-3-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/2576-5-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/2576-8-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/2648-1-0x0000000000090000-0x0000000000190000-memory.dmp

Filesize
1024KB

Download
memory/2648-2-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download