blustealer | 3604207260cf40780709d081796c8e86cc810f688e2973b1d325b01f40169030

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 12:24

Target

40da869663b70d81a92ec0bdb29ef61d.exe
Size

2.6MB
MD5

40da869663b70d81a92ec0bdb29ef61d
SHA1

c37ca05022049f320a6bf2e72a2be07e73004841
SHA256

3604207260cf40780709d081796c8e86cc810f688e2973b1d325b01f40169030
SHA512

53d5a6f170516ce2b497bdd941e919506f18ce61db7102f6b61d4e31ddaaa813ab727e3d7ed90d94fb2ea6e9bac5c65f32f14849dd10fbe31bf4ed2e093e1100
SSDEEP

24576:T8QxsrJyXFN1ggvYwM/KhgTkC+bLXu7ckQ6eHmPm:TVQJg/gFuRPG+

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2744-4-0x0000000000300000-0x0000000000316000-memory.dmp	family_zgrat_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2744 set thread context of 3032	2744	40da869663b70d81a92ec0bdb29ef61d.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3032	40da869663b70d81a92ec0bdb29ef61d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 3032	2744	40da869663b70d81a92ec0bdb29ef61d.exe	28
PID 2744 wrote to memory of 3032	2744	40da869663b70d81a92ec0bdb29ef61d.exe	28
PID 2744 wrote to memory of 3032	2744	40da869663b70d81a92ec0bdb29ef61d.exe	28
PID 2744 wrote to memory of 3032	2744	40da869663b70d81a92ec0bdb29ef61d.exe	28
PID 2744 wrote to memory of 3032	2744	40da869663b70d81a92ec0bdb29ef61d.exe	28
PID 2744 wrote to memory of 3032	2744	40da869663b70d81a92ec0bdb29ef61d.exe	28
PID 2744 wrote to memory of 3032	2744	40da869663b70d81a92ec0bdb29ef61d.exe	28
PID 2744 wrote to memory of 3032	2744	40da869663b70d81a92ec0bdb29ef61d.exe	28
PID 2744 wrote to memory of 3032	2744	40da869663b70d81a92ec0bdb29ef61d.exe	28

C:\Users\Admin\AppData\Local\Temp\40da869663b70d81a92ec0bdb29ef61d.exe
"C:\Users\Admin\AppData\Local\Temp\40da869663b70d81a92ec0bdb29ef61d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\AppData\Local\Temp\40da869663b70d81a92ec0bdb29ef61d.exe
  "C:\Users\Admin\AppData\Local\Temp\40da869663b70d81a92ec0bdb29ef61d.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3032

memory/2744-0-0x0000000074D10000-0x00000000753FE000-memory.dmp

Filesize
6.9MB

Download
memory/2744-1-0x00000000008B0000-0x0000000000B4E000-memory.dmp

Filesize
2.6MB

Download
memory/2744-2-0x0000000004EE0000-0x0000000004F20000-memory.dmp

Filesize
256KB

Download
memory/2744-3-0x0000000004D60000-0x0000000004ED4000-memory.dmp

Filesize
1.5MB

Download
memory/2744-4-0x0000000000300000-0x0000000000316000-memory.dmp

Filesize
88KB

Download
memory/2744-15-0x0000000074D10000-0x00000000753FE000-memory.dmp

Filesize
6.9MB

Download
memory/3032-5-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/3032-14-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/3032-12-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/3032-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3032-8-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/3032-7-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download