blustealer | dafada11163e9ed5459a4759f6f18561db820214a5ce6f0752083af1faf70369

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2024 08:37

Target

5f7134568181281194c9d80c2cba6027.exe
Size

1.0MB
MD5

5f7134568181281194c9d80c2cba6027
SHA1

7c63780e87612a84afdc50d1b0a463c5f27c1e53
SHA256

dafada11163e9ed5459a4759f6f18561db820214a5ce6f0752083af1faf70369
SHA512

72d9ff25d2c158a5ae371a5d0d5a16f61a8c5b3974f6c3f407fcb94ab44e9f3ba3cec95429d2b2417558e7e1e919e90154830da7102cce68d7370e2b8f237867
SSDEEP

24576:zqqoAUj2c1x9TGP5wJXcb7UfFku94VNpL8JxkE:zqaU3hyP5wJXc6ku9UL8DkE

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 784 set thread context of 1800	784	5f7134568181281194c9d80c2cba6027.exe	97

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1800	5f7134568181281194c9d80c2cba6027.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 1800	784	5f7134568181281194c9d80c2cba6027.exe	97
PID 784 wrote to memory of 1800	784	5f7134568181281194c9d80c2cba6027.exe	97
PID 784 wrote to memory of 1800	784	5f7134568181281194c9d80c2cba6027.exe	97
PID 784 wrote to memory of 1800	784	5f7134568181281194c9d80c2cba6027.exe	97
PID 784 wrote to memory of 1800	784	5f7134568181281194c9d80c2cba6027.exe	97
PID 784 wrote to memory of 1800	784	5f7134568181281194c9d80c2cba6027.exe	97
PID 784 wrote to memory of 1800	784	5f7134568181281194c9d80c2cba6027.exe	97
PID 784 wrote to memory of 1800	784	5f7134568181281194c9d80c2cba6027.exe	97

C:\Users\Admin\AppData\Local\Temp\5f7134568181281194c9d80c2cba6027.exe
"C:\Users\Admin\AppData\Local\Temp\5f7134568181281194c9d80c2cba6027.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:784
- C:\Users\Admin\AppData\Local\Temp\5f7134568181281194c9d80c2cba6027.exe
  "C:\Users\Admin\AppData\Local\Temp\5f7134568181281194c9d80c2cba6027.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1800

memory/784-8-0x0000000074EA0000-0x0000000075650000-memory.dmp

Filesize
7.7MB

Download
memory/784-6-0x0000000005B40000-0x0000000005BDC000-memory.dmp

Filesize
624KB

Download
memory/784-2-0x0000000005CA0000-0x0000000006244000-memory.dmp

Filesize
5.6MB

Download
memory/784-3-0x0000000005790000-0x0000000005822000-memory.dmp

Filesize
584KB

Download
memory/784-1-0x0000000074EA0000-0x0000000075650000-memory.dmp

Filesize
7.7MB

Download
memory/784-5-0x0000000005770000-0x000000000577A000-memory.dmp

Filesize
40KB

Download
memory/784-0-0x0000000000C50000-0x0000000000D62000-memory.dmp

Filesize
1.1MB

Download
memory/784-7-0x0000000005930000-0x0000000005948000-memory.dmp

Filesize
96KB

Download
memory/784-4-0x0000000005990000-0x00000000059A0000-memory.dmp

Filesize
64KB

Download
memory/784-9-0x0000000005990000-0x00000000059A0000-memory.dmp

Filesize
64KB

Download
memory/784-10-0x0000000006910000-0x00000000069F2000-memory.dmp

Filesize
904KB

Download
memory/784-11-0x0000000006600000-0x0000000006678000-memory.dmp

Filesize
480KB

Download
memory/784-16-0x0000000074EA0000-0x0000000075650000-memory.dmp

Filesize
7.7MB

Download
memory/1800-12-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1800-15-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1800-19-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download