blustealer | 9baf7fbee2e201926f1b7974d5d09db33aece7bd49148a23b7108aed2cbbec5c

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2024 02:00

Target

60ee6f9a2741eb675a9982dde799e8c6.exe
Size

580KB
MD5

60ee6f9a2741eb675a9982dde799e8c6
SHA1

2b6e981b82554135bc19c6fc554a9830fe90fa0b
SHA256

9baf7fbee2e201926f1b7974d5d09db33aece7bd49148a23b7108aed2cbbec5c
SHA512

03f9dc139b8f7226493512a5a2460621be40879bf94c5baf862e42b9e7528225a1969440a93082d44faade10532e1025cac14f034055e4294dbe74fa8c492b6a
SSDEEP

12288:KDOVYiGEVIoPzTJ3bHu6nOo88qfhS6a64OVGJfuGnl0W:KKBIWzTJDum+8qfgNlX

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3152 set thread context of 4672	3152	60ee6f9a2741eb675a9982dde799e8c6.exe	85

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3152	60ee6f9a2741eb675a9982dde799e8c6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4672	60ee6f9a2741eb675a9982dde799e8c6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 4672	3152	60ee6f9a2741eb675a9982dde799e8c6.exe	85
PID 3152 wrote to memory of 4672	3152	60ee6f9a2741eb675a9982dde799e8c6.exe	85
PID 3152 wrote to memory of 4672	3152	60ee6f9a2741eb675a9982dde799e8c6.exe	85
PID 3152 wrote to memory of 4672	3152	60ee6f9a2741eb675a9982dde799e8c6.exe	85

C:\Users\Admin\AppData\Local\Temp\60ee6f9a2741eb675a9982dde799e8c6.exe
"C:\Users\Admin\AppData\Local\Temp\60ee6f9a2741eb675a9982dde799e8c6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Users\Admin\AppData\Local\Temp\60ee6f9a2741eb675a9982dde799e8c6.exe
  "C:\Users\Admin\AppData\Local\Temp\60ee6f9a2741eb675a9982dde799e8c6.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4672

memory/3152-1-0x0000000003030000-0x0000000003032000-memory.dmp

Filesize
8KB

Download
memory/3152-0-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Filesize
132KB

Download
memory/3152-4-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Filesize
132KB

Download
memory/4672-2-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4672-5-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4672-8-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download