blustealer | dafada11163e9ed5459a4759f6f18561db820214a5ce6f0752083af1faf70369

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
16-01-2024 08:37

Target

5f7134568181281194c9d80c2cba6027.exe
Size

1.0MB
MD5

5f7134568181281194c9d80c2cba6027
SHA1

7c63780e87612a84afdc50d1b0a463c5f27c1e53
SHA256

dafada11163e9ed5459a4759f6f18561db820214a5ce6f0752083af1faf70369
SHA512

72d9ff25d2c158a5ae371a5d0d5a16f61a8c5b3974f6c3f407fcb94ab44e9f3ba3cec95429d2b2417558e7e1e919e90154830da7102cce68d7370e2b8f237867
SSDEEP

24576:zqqoAUj2c1x9TGP5wJXcb7UfFku94VNpL8JxkE:zqaU3hyP5wJXc6ku9UL8DkE

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2104 set thread context of 1736	2104	5f7134568181281194c9d80c2cba6027.exe	30

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1736	5f7134568181281194c9d80c2cba6027.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1736	2104	5f7134568181281194c9d80c2cba6027.exe	30
PID 2104 wrote to memory of 1736	2104	5f7134568181281194c9d80c2cba6027.exe	30
PID 2104 wrote to memory of 1736	2104	5f7134568181281194c9d80c2cba6027.exe	30
PID 2104 wrote to memory of 1736	2104	5f7134568181281194c9d80c2cba6027.exe	30
PID 2104 wrote to memory of 1736	2104	5f7134568181281194c9d80c2cba6027.exe	30
PID 2104 wrote to memory of 1736	2104	5f7134568181281194c9d80c2cba6027.exe	30
PID 2104 wrote to memory of 1736	2104	5f7134568181281194c9d80c2cba6027.exe	30
PID 2104 wrote to memory of 1736	2104	5f7134568181281194c9d80c2cba6027.exe	30
PID 2104 wrote to memory of 1736	2104	5f7134568181281194c9d80c2cba6027.exe	30

C:\Users\Admin\AppData\Local\Temp\5f7134568181281194c9d80c2cba6027.exe
"C:\Users\Admin\AppData\Local\Temp\5f7134568181281194c9d80c2cba6027.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\AppData\Local\Temp\5f7134568181281194c9d80c2cba6027.exe
  "C:\Users\Admin\AppData\Local\Temp\5f7134568181281194c9d80c2cba6027.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1736

memory/1736-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1736-10-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1736-20-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1736-16-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1736-8-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1736-14-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1736-9-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2104-6-0x00000000057F0000-0x00000000058D2000-memory.dmp

Filesize
904KB

Download
memory/2104-4-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2104-1-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2104-7-0x0000000007DC0000-0x0000000007E38000-memory.dmp

Filesize
480KB

Download
memory/2104-5-0x0000000004F80000-0x0000000004FC0000-memory.dmp

Filesize
256KB

Download
memory/2104-0-0x0000000000ED0000-0x0000000000FE2000-memory.dmp

Filesize
1.1MB

Download
memory/2104-3-0x0000000000780000-0x0000000000798000-memory.dmp

Filesize
96KB

Download
memory/2104-18-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2104-2-0x0000000004F80000-0x0000000004FC0000-memory.dmp

Filesize
256KB

Download