blustealer | 42fe72df91aa852b257cc3227329eb5bf4fce5dabff34cd0093f1298e3b5454e

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-01-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fe6ba1439d88cf7fd8debb37324ce82.exe
Size

700KB
MD5

6fe6ba1439d88cf7fd8debb37324ce82
SHA1

6dd21af92d79085a4140be5db5c6faa7c5de2f81
SHA256

42fe72df91aa852b257cc3227329eb5bf4fce5dabff34cd0093f1298e3b5454e
SHA512

748a231fe1827a4196c27419fa9da80aefd0c7f77259125c567683ea9e4481d4f4e26dbf2946f7fa73572ce8b9548e96ea60a3772f9d39953953bc6b4ee8da45
SSDEEP

12288:X7A4e3AWh7HmCo3PtAlMvc+ml5hy8MLlMUa5eYgeTgzXkYkbfytNE13+MMJnIXNN:X7sT7GV3ktv5y/zXkYgF+M603

Score

10^/10

blustealer zgrat persistence rat stealer

Malware Config

Extracted

Family

blustealer

Credentials

Protocol: smtp
Host:
bojtai.club
Port:
587
Username:
[email protected]
Password:
S8(OUzB)pvph

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral1/memory/1944-7-0x0000000004820000-0x000000000489C000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-8-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-33-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-31-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-57-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-71-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-69-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-67-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-65-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-63-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-61-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-59-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-55-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-53-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-51-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-49-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-47-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-45-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-43-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-41-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-39-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-37-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-35-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-29-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-27-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-25-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-23-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-21-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-19-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-17-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-15-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-13-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-11-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1
behavioral1/memory/1944-9-0x0000000004820000-0x0000000004897000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Deletes itself 1 IoCs

pid	Process
2424	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrom = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\chrome\\chrom.exe\""	6fe6ba1439d88cf7fd8debb37324ce82.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1944 set thread context of 2012	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1944	6fe6ba1439d88cf7fd8debb37324ce82.exe
1944	6fe6ba1439d88cf7fd8debb37324ce82.exe
1944	6fe6ba1439d88cf7fd8debb37324ce82.exe
1944	6fe6ba1439d88cf7fd8debb37324ce82.exe
1944	6fe6ba1439d88cf7fd8debb37324ce82.exe
1944	6fe6ba1439d88cf7fd8debb37324ce82.exe
1944	6fe6ba1439d88cf7fd8debb37324ce82.exe
1944	6fe6ba1439d88cf7fd8debb37324ce82.exe
1944	6fe6ba1439d88cf7fd8debb37324ce82.exe
1944	6fe6ba1439d88cf7fd8debb37324ce82.exe
1944	6fe6ba1439d88cf7fd8debb37324ce82.exe
1944	6fe6ba1439d88cf7fd8debb37324ce82.exe
1944	6fe6ba1439d88cf7fd8debb37324ce82.exe
1944	6fe6ba1439d88cf7fd8debb37324ce82.exe
2424	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe
Token: SeDebugPrivilege	2424	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2012	6fe6ba1439d88cf7fd8debb37324ce82.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2424	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	30
PID 1944 wrote to memory of 2424	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	30
PID 1944 wrote to memory of 2424	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	30
PID 1944 wrote to memory of 2424	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	30
PID 1944 wrote to memory of 2044	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	32
PID 1944 wrote to memory of 2044	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	32
PID 1944 wrote to memory of 2044	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	32
PID 1944 wrote to memory of 2044	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	32
PID 1944 wrote to memory of 2916	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	33
PID 1944 wrote to memory of 2916	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	33
PID 1944 wrote to memory of 2916	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	33
PID 1944 wrote to memory of 2916	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	33
PID 1944 wrote to memory of 2028	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	34
PID 1944 wrote to memory of 2028	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	34
PID 1944 wrote to memory of 2028	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	34
PID 1944 wrote to memory of 2028	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	34
PID 1944 wrote to memory of 2012	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	35
PID 1944 wrote to memory of 2012	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	35
PID 1944 wrote to memory of 2012	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	35
PID 1944 wrote to memory of 2012	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	35
PID 1944 wrote to memory of 2012	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	35
PID 1944 wrote to memory of 2012	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	35
PID 1944 wrote to memory of 2012	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	35
PID 1944 wrote to memory of 2012	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	35
PID 1944 wrote to memory of 2012	1944	6fe6ba1439d88cf7fd8debb37324ce82.exe	35

C:\Users\Admin\AppData\Local\Temp\6fe6ba1439d88cf7fd8debb37324ce82.exe
"C:\Users\Admin\AppData\Local\Temp\6fe6ba1439d88cf7fd8debb37324ce82.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\AppData\Local\Temp\6fe6ba1439d88cf7fd8debb37324ce82.exe" -Force
  2⤵
  - Deletes itself
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Users\Admin\AppData\Local\Temp\6fe6ba1439d88cf7fd8debb37324ce82.exe
  C:\Users\Admin\AppData\Local\Temp\6fe6ba1439d88cf7fd8debb37324ce82.exe
  2⤵
  PID:2044
- C:\Users\Admin\AppData\Local\Temp\6fe6ba1439d88cf7fd8debb37324ce82.exe
  C:\Users\Admin\AppData\Local\Temp\6fe6ba1439d88cf7fd8debb37324ce82.exe
  2⤵
  PID:2916
- C:\Users\Admin\AppData\Local\Temp\6fe6ba1439d88cf7fd8debb37324ce82.exe
  C:\Users\Admin\AppData\Local\Temp\6fe6ba1439d88cf7fd8debb37324ce82.exe
  2⤵
  PID:2028
- C:\Users\Admin\AppData\Local\Temp\6fe6ba1439d88cf7fd8debb37324ce82.exe
  C:\Users\Admin\AppData\Local\Temp\6fe6ba1439d88cf7fd8debb37324ce82.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-45-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-6-0x00000000050D0000-0x000000000517A000-memory.dmp

Filesize
680KB

Download
memory/1944-2-0x0000000004DE0000-0x0000000004E20000-memory.dmp

Filesize
256KB

Download
memory/1944-3-0x0000000004DE0000-0x0000000004E20000-memory.dmp

Filesize
256KB

Download
memory/1944-4-0x0000000074980000-0x000000007506E000-memory.dmp

Filesize
6.9MB

Download
memory/1944-5-0x0000000004DE0000-0x0000000004E20000-memory.dmp

Filesize
256KB

Download
memory/1944-43-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-7-0x0000000004820000-0x000000000489C000-memory.dmp

Filesize
496KB

Download
memory/1944-8-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-33-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-31-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-41-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-71-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-69-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-67-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-65-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-63-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-61-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-59-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-55-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-0-0x00000000000D0000-0x0000000000184000-memory.dmp

Filesize
720KB

Download
memory/1944-51-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-49-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-47-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-53-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-1-0x0000000074980000-0x000000007506E000-memory.dmp

Filesize
6.9MB

Download
memory/1944-57-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-39-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-37-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-35-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-29-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-27-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-25-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-23-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-21-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-19-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-17-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-15-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-13-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-11-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-9-0x0000000004820000-0x0000000004897000-memory.dmp

Filesize
476KB

Download
memory/1944-2464-0x0000000074980000-0x000000007506E000-memory.dmp

Filesize
6.9MB

Download
memory/2012-2466-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2012-2472-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2424-2470-0x0000000074970000-0x0000000074F1B000-memory.dmp

Filesize
5.7MB

Download
memory/2424-2471-0x0000000002AC0000-0x0000000002B00000-memory.dmp

Filesize
256KB

Download
memory/2424-2474-0x0000000002AC0000-0x0000000002B00000-memory.dmp

Filesize
256KB

Download
memory/2424-2473-0x0000000074970000-0x0000000074F1B000-memory.dmp

Filesize
5.7MB

Download
memory/2424-2475-0x0000000074970000-0x0000000074F1B000-memory.dmp

Filesize
5.7MB

Download