blustealer | b281be38a190ca97b700202096f56b29ff68740c0d40273f286e03d52685321e

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 16:04

Target

53f6d4b448f270023ee30f231c53cf5d.exe
Size

486KB
MD5

53f6d4b448f270023ee30f231c53cf5d
SHA1

c58946d81281aa1907c8e31273f67e14f3c8ba3b
SHA256

b281be38a190ca97b700202096f56b29ff68740c0d40273f286e03d52685321e
SHA512

18c08c35498c98545042b21592b6357806626a42c2eca4fb4333104e022696586d907c1b82d31693031cf9abd1b3a319500758e715fbadc7d04c0ea4d3e2bfea
SSDEEP

12288:mxDp/GBC1aNaJ+W3YQyaOfujHwx7Eqi9gPQeuab:mdBGsQN49ozxIqJruw

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 660 set thread context of 2672	660	53f6d4b448f270023ee30f231c53cf5d.exe	29

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
660	53f6d4b448f270023ee30f231c53cf5d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2672	53f6d4b448f270023ee30f231c53cf5d.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 2672	660	53f6d4b448f270023ee30f231c53cf5d.exe	29
PID 660 wrote to memory of 2672	660	53f6d4b448f270023ee30f231c53cf5d.exe	29
PID 660 wrote to memory of 2672	660	53f6d4b448f270023ee30f231c53cf5d.exe	29
PID 660 wrote to memory of 2672	660	53f6d4b448f270023ee30f231c53cf5d.exe	29
PID 660 wrote to memory of 2672	660	53f6d4b448f270023ee30f231c53cf5d.exe	29

C:\Users\Admin\AppData\Local\Temp\53f6d4b448f270023ee30f231c53cf5d.exe
"C:\Users\Admin\AppData\Local\Temp\53f6d4b448f270023ee30f231c53cf5d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:660
- C:\Users\Admin\AppData\Local\Temp\53f6d4b448f270023ee30f231c53cf5d.exe
  "C:\Users\Admin\AppData\Local\Temp\53f6d4b448f270023ee30f231c53cf5d.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2672

memory/660-0-0x00000000001A0000-0x00000000001A6000-memory.dmp

Filesize
24KB

Download
memory/2672-1-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2672-6-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download