blustealer | 9baf7fbee2e201926f1b7974d5d09db33aece7bd49148a23b7108aed2cbbec5c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 02:00

Target

60ee6f9a2741eb675a9982dde799e8c6.exe
Size

580KB
MD5

60ee6f9a2741eb675a9982dde799e8c6
SHA1

2b6e981b82554135bc19c6fc554a9830fe90fa0b
SHA256

9baf7fbee2e201926f1b7974d5d09db33aece7bd49148a23b7108aed2cbbec5c
SHA512

03f9dc139b8f7226493512a5a2460621be40879bf94c5baf862e42b9e7528225a1969440a93082d44faade10532e1025cac14f034055e4294dbe74fa8c492b6a
SSDEEP

12288:KDOVYiGEVIoPzTJ3bHu6nOo88qfhS6a64OVGJfuGnl0W:KKBIWzTJDum+8qfgNlX

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1936 set thread context of 2736	1936	60ee6f9a2741eb675a9982dde799e8c6.exe	29

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1936	60ee6f9a2741eb675a9982dde799e8c6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2736	60ee6f9a2741eb675a9982dde799e8c6.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2736	1936	60ee6f9a2741eb675a9982dde799e8c6.exe	29
PID 1936 wrote to memory of 2736	1936	60ee6f9a2741eb675a9982dde799e8c6.exe	29
PID 1936 wrote to memory of 2736	1936	60ee6f9a2741eb675a9982dde799e8c6.exe	29
PID 1936 wrote to memory of 2736	1936	60ee6f9a2741eb675a9982dde799e8c6.exe	29
PID 1936 wrote to memory of 2736	1936	60ee6f9a2741eb675a9982dde799e8c6.exe	29

C:\Users\Admin\AppData\Local\Temp\60ee6f9a2741eb675a9982dde799e8c6.exe
"C:\Users\Admin\AppData\Local\Temp\60ee6f9a2741eb675a9982dde799e8c6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\60ee6f9a2741eb675a9982dde799e8c6.exe
  "C:\Users\Admin\AppData\Local\Temp\60ee6f9a2741eb675a9982dde799e8c6.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2736

memory/1936-0-0x00000000002D0000-0x00000000002F1000-memory.dmp

Filesize
132KB

Download
memory/1936-2-0x0000000000110000-0x0000000000112000-memory.dmp

Filesize
8KB

Download
memory/1936-4-0x00000000002D0000-0x00000000002F1000-memory.dmp

Filesize
132KB

Download
memory/2736-1-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2736-8-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2736-9-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download