blustealer | ab7e2f3d96941792e0be9139f29d555c350123f8be701c6cd0f132c98f351407

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 13:40

Target

e1d4a036b94386f0d33843622fab1bad.exe
Size

1.8MB
MD5

e1d4a036b94386f0d33843622fab1bad
SHA1

ea5e11f919586f87d34a8039afb9308b93a07f63
SHA256

ab7e2f3d96941792e0be9139f29d555c350123f8be701c6cd0f132c98f351407
SHA512

83d6c35c9524add1df097f5e66ab72f0a2e4bf818ec5ab5c9d01631a920f6cf35c88952b7ae936eaedc85ede7301ac9988ad5326cc9fd904eaeee78046b28d58
SSDEEP

49152:fhZUoHMjmCm6Ud+zyXc6dnS3vt05IVqCVhT6DDt:fhZUosjmCmN+mRnI+m6

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral1/memory/1848-3-0x00000000005B0000-0x00000000005C2000-memory.dmp	CustAttr

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1848 set thread context of 2824	1848	e1d4a036b94386f0d33843622fab1bad.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1848	e1d4a036b94386f0d33843622fab1bad.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	e1d4a036b94386f0d33843622fab1bad.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2824	e1d4a036b94386f0d33843622fab1bad.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2832	1848	e1d4a036b94386f0d33843622fab1bad.exe	28
PID 1848 wrote to memory of 2832	1848	e1d4a036b94386f0d33843622fab1bad.exe	28
PID 1848 wrote to memory of 2832	1848	e1d4a036b94386f0d33843622fab1bad.exe	28
PID 1848 wrote to memory of 2832	1848	e1d4a036b94386f0d33843622fab1bad.exe	28
PID 1848 wrote to memory of 2824	1848	e1d4a036b94386f0d33843622fab1bad.exe	30
PID 1848 wrote to memory of 2824	1848	e1d4a036b94386f0d33843622fab1bad.exe	30
PID 1848 wrote to memory of 2824	1848	e1d4a036b94386f0d33843622fab1bad.exe	30
PID 1848 wrote to memory of 2824	1848	e1d4a036b94386f0d33843622fab1bad.exe	30
PID 1848 wrote to memory of 2824	1848	e1d4a036b94386f0d33843622fab1bad.exe	30
PID 1848 wrote to memory of 2824	1848	e1d4a036b94386f0d33843622fab1bad.exe	30
PID 1848 wrote to memory of 2824	1848	e1d4a036b94386f0d33843622fab1bad.exe	30
PID 1848 wrote to memory of 2824	1848	e1d4a036b94386f0d33843622fab1bad.exe	30
PID 1848 wrote to memory of 2824	1848	e1d4a036b94386f0d33843622fab1bad.exe	30

C:\Users\Admin\AppData\Local\Temp\e1d4a036b94386f0d33843622fab1bad.exe
"C:\Users\Admin\AppData\Local\Temp\e1d4a036b94386f0d33843622fab1bad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\e1d4a036b94386f0d33843622fab1bad.exe
  "C:\Users\Admin\AppData\Local\Temp\e1d4a036b94386f0d33843622fab1bad.exe"
  2⤵
  PID:2832
- C:\Users\Admin\AppData\Local\Temp\e1d4a036b94386f0d33843622fab1bad.exe
  "C:\Users\Admin\AppData\Local\Temp\e1d4a036b94386f0d33843622fab1bad.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2824

memory/1848-1-0x0000000074880000-0x0000000074F6E000-memory.dmp

Filesize
6.9MB

Download
memory/1848-0-0x0000000000C60000-0x0000000000E3A000-memory.dmp

Filesize
1.9MB

Download
memory/1848-2-0x00000000049A0000-0x00000000049E0000-memory.dmp

Filesize
256KB

Download
memory/1848-3-0x00000000005B0000-0x00000000005C2000-memory.dmp

Filesize
72KB

Download
memory/1848-4-0x0000000074880000-0x0000000074F6E000-memory.dmp

Filesize
6.9MB

Download
memory/1848-5-0x00000000049A0000-0x00000000049E0000-memory.dmp

Filesize
256KB

Download
memory/1848-6-0x0000000006560000-0x0000000006670000-memory.dmp

Filesize
1.1MB

Download
memory/1848-7-0x0000000005150000-0x000000000521A000-memory.dmp

Filesize
808KB

Download
memory/1848-19-0x0000000074880000-0x0000000074F6E000-memory.dmp

Filesize
6.9MB

Download
memory/2824-16-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2824-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2824-10-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2824-9-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2824-8-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download