blustealer | de6888f1ef690aa50759f234c0182710aaa2c07abdb6d3a871f8a72e43fa19e2

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 14:19

Target

7276059c9e3372eddfcd6aa0a0ab1b17.exe
Size

522KB
MD5

7276059c9e3372eddfcd6aa0a0ab1b17
SHA1

e94d1ace20b2def6a29545afac2e8f8edaccc4d6
SHA256

de6888f1ef690aa50759f234c0182710aaa2c07abdb6d3a871f8a72e43fa19e2
SHA512

237c295f707abcddbb6b04222707cc3e1e0768f25fac4f02b594031a1c0e0a6edacf229acf129291ba08a545fbd6b27aec6e21915f80cef9745a7cb4b56b1047
SSDEEP

12288:mDD+nI3ELe0zyK5nffe6OD8+zwQ8O6l291vU6+u/hZZ5QhTuVdVP:aDwLptne68EjE91vOu/Xbl

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3016 set thread context of 4804	3016	7276059c9e3372eddfcd6aa0a0ab1b17.exe	83

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3016	7276059c9e3372eddfcd6aa0a0ab1b17.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4804	7276059c9e3372eddfcd6aa0a0ab1b17.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 4804	3016	7276059c9e3372eddfcd6aa0a0ab1b17.exe	83
PID 3016 wrote to memory of 4804	3016	7276059c9e3372eddfcd6aa0a0ab1b17.exe	83
PID 3016 wrote to memory of 4804	3016	7276059c9e3372eddfcd6aa0a0ab1b17.exe	83
PID 3016 wrote to memory of 4804	3016	7276059c9e3372eddfcd6aa0a0ab1b17.exe	83

C:\Users\Admin\AppData\Local\Temp\7276059c9e3372eddfcd6aa0a0ab1b17.exe
"C:\Users\Admin\AppData\Local\Temp\7276059c9e3372eddfcd6aa0a0ab1b17.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\7276059c9e3372eddfcd6aa0a0ab1b17.exe
  "C:\Users\Admin\AppData\Local\Temp\7276059c9e3372eddfcd6aa0a0ab1b17.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4804

memory/3016-1-0x0000000000600000-0x0000000000700000-memory.dmp

Filesize
1024KB

Download
memory/3016-2-0x0000000000830000-0x0000000000832000-memory.dmp

Filesize
8KB

Download
memory/4804-3-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4804-5-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4804-8-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download