blustealer | ab7e2f3d96941792e0be9139f29d555c350123f8be701c6cd0f132c98f351407

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2023 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1d4a036b94386f0d33843622fab1bad.exe
Size

1.8MB
MD5

e1d4a036b94386f0d33843622fab1bad
SHA1

ea5e11f919586f87d34a8039afb9308b93a07f63
SHA256

ab7e2f3d96941792e0be9139f29d555c350123f8be701c6cd0f132c98f351407
SHA512

83d6c35c9524add1df097f5e66ab72f0a2e4bf818ec5ab5c9d01631a920f6cf35c88952b7ae936eaedc85ede7301ac9988ad5326cc9fd904eaeee78046b28d58
SSDEEP

49152:fhZUoHMjmCm6Ud+zyXc6dnS3vt05IVqCVhT6DDt:fhZUosjmCmN+mRnI+m6

Score

10^/10

blustealer stealer

Malware Config

Extracted

Family

blustealer

Credentials

Protocol: smtp
Host:
mail.dm-teh.com
Port:
587
Username:
[email protected]
Password:
Vm@(O;CO.vEQ

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral2/memory/3972-8-0x0000000005BA0000-0x0000000005BB2000-memory.dmp	CustAttr

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3972 set thread context of 3032	3972	e1d4a036b94386f0d33843622fab1bad.exe	104

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3972	e1d4a036b94386f0d33843622fab1bad.exe
3972	e1d4a036b94386f0d33843622fab1bad.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3972	e1d4a036b94386f0d33843622fab1bad.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3032	e1d4a036b94386f0d33843622fab1bad.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 3832	3972	e1d4a036b94386f0d33843622fab1bad.exe	103
PID 3972 wrote to memory of 3832	3972	e1d4a036b94386f0d33843622fab1bad.exe	103
PID 3972 wrote to memory of 3832	3972	e1d4a036b94386f0d33843622fab1bad.exe	103
PID 3972 wrote to memory of 3032	3972	e1d4a036b94386f0d33843622fab1bad.exe	104
PID 3972 wrote to memory of 3032	3972	e1d4a036b94386f0d33843622fab1bad.exe	104
PID 3972 wrote to memory of 3032	3972	e1d4a036b94386f0d33843622fab1bad.exe	104
PID 3972 wrote to memory of 3032	3972	e1d4a036b94386f0d33843622fab1bad.exe	104
PID 3972 wrote to memory of 3032	3972	e1d4a036b94386f0d33843622fab1bad.exe	104
PID 3972 wrote to memory of 3032	3972	e1d4a036b94386f0d33843622fab1bad.exe	104
PID 3972 wrote to memory of 3032	3972	e1d4a036b94386f0d33843622fab1bad.exe	104
PID 3972 wrote to memory of 3032	3972	e1d4a036b94386f0d33843622fab1bad.exe	104

C:\Users\Admin\AppData\Local\Temp\e1d4a036b94386f0d33843622fab1bad.exe
"C:\Users\Admin\AppData\Local\Temp\e1d4a036b94386f0d33843622fab1bad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Users\Admin\AppData\Local\Temp\e1d4a036b94386f0d33843622fab1bad.exe
  "C:\Users\Admin\AppData\Local\Temp\e1d4a036b94386f0d33843622fab1bad.exe"
  2⤵
  PID:3832
- C:\Users\Admin\AppData\Local\Temp\e1d4a036b94386f0d33843622fab1bad.exe
  "C:\Users\Admin\AppData\Local\Temp\e1d4a036b94386f0d33843622fab1bad.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3032-13-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/3032-20-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/3032-16-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/3972-8-0x0000000005BA0000-0x0000000005BB2000-memory.dmp

Filesize
72KB

Download
memory/3972-10-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/3972-5-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/3972-6-0x0000000004C50000-0x0000000004C5A000-memory.dmp

Filesize
40KB

Download
memory/3972-7-0x0000000004F30000-0x0000000004F86000-memory.dmp

Filesize
344KB

Download
memory/3972-0-0x0000000074400000-0x0000000074BB0000-memory.dmp

Filesize
7.7MB

Download
memory/3972-9-0x0000000074400000-0x0000000074BB0000-memory.dmp

Filesize
7.7MB

Download
memory/3972-4-0x0000000004D70000-0x0000000004E02000-memory.dmp

Filesize
584KB

Download
memory/3972-11-0x0000000006A40000-0x0000000006B50000-memory.dmp

Filesize
1.1MB

Download
memory/3972-12-0x0000000006B50000-0x0000000006C1A000-memory.dmp

Filesize
808KB

Download
memory/3972-3-0x0000000005320000-0x00000000058C4000-memory.dmp

Filesize
5.6MB

Download
memory/3972-2-0x0000000004CD0000-0x0000000004D6C000-memory.dmp

Filesize
624KB

Download
memory/3972-18-0x0000000074400000-0x0000000074BB0000-memory.dmp

Filesize
7.7MB

Download
memory/3972-1-0x0000000000080000-0x000000000025A000-memory.dmp

Filesize
1.9MB

Download