blustealer | c22a98c5ef21699cf1b2e45b25cd04bbb44121078f2604820606e9455673735a

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-01-2024 05:40

Target

7f074da2194055199bec9996fcc382bc.exe
Size

498KB
MD5

7f074da2194055199bec9996fcc382bc
SHA1

a463f7184593956742f6c61d55b0f4db8df10b84
SHA256

c22a98c5ef21699cf1b2e45b25cd04bbb44121078f2604820606e9455673735a
SHA512

f1641d016b7afa10104f1b244b00a9b20c8589bb4186a97b471f3f62dcc8eaa48f438dc6dbda85457c8a1c6552b1e966a5ebbfc1d7b84722af54704196749a2c
SSDEEP

12288:S2wyuuPGC/7X1yAP1egsPi183uT4BsPBTTjo1vorHF/:Zwq/7V1eVa1837Bs1TOorHF/

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2420 set thread context of 2320	2420	7f074da2194055199bec9996fcc382bc.exe	28

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2420	7f074da2194055199bec9996fcc382bc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2320	7f074da2194055199bec9996fcc382bc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2320	2420	7f074da2194055199bec9996fcc382bc.exe	28
PID 2420 wrote to memory of 2320	2420	7f074da2194055199bec9996fcc382bc.exe	28
PID 2420 wrote to memory of 2320	2420	7f074da2194055199bec9996fcc382bc.exe	28
PID 2420 wrote to memory of 2320	2420	7f074da2194055199bec9996fcc382bc.exe	28
PID 2420 wrote to memory of 2320	2420	7f074da2194055199bec9996fcc382bc.exe	28

C:\Users\Admin\AppData\Local\Temp\7f074da2194055199bec9996fcc382bc.exe
"C:\Users\Admin\AppData\Local\Temp\7f074da2194055199bec9996fcc382bc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\7f074da2194055199bec9996fcc382bc.exe
  "C:\Users\Admin\AppData\Local\Temp\7f074da2194055199bec9996fcc382bc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2320

memory/2320-3-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2320-8-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2420-2-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/2420-1-0x0000000000220000-0x0000000000320000-memory.dmp

Filesize
1024KB

Download