Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    06-02-2024 07:15

General

  • Target

    941ffbcc54a5826dde6e2d35f2fc761d.exe

  • Size

    489KB

  • MD5

    941ffbcc54a5826dde6e2d35f2fc761d

  • SHA1

    fc892954c47237abfc7956450aa13e5ad2d97488

  • SHA256

    4a0b8f4dbb3acd1bbab1527d90921061bef21f3422250dcc41b8046b77edbd9b

  • SHA512

    85327aa14dfdd4f7e8fb8387fc8f47066abd5037cb3d080444d17e40fb7d49803b86c5d971b434f872130a152590ac14df1fc3025954625cd9ec637c71b2e635

  • SSDEEP

    12288:+pxLkSqnEa1yg6PbvF1yC62hkh2pf05T70sZ0XNfM:jaZ1yQC5gXtM

Score
10/10

Malware Config

Extracted

Family

blustealer

Credentials

  • Protocol:
    smtp
  • Host:
    mail.dm-teh.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Vm@(O;CO.vEQ

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\941ffbcc54a5826dde6e2d35f2fc761d.exe
    "C:\Users\Admin\AppData\Local\Temp\941ffbcc54a5826dde6e2d35f2fc761d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Users\Admin\AppData\Local\Temp\941ffbcc54a5826dde6e2d35f2fc761d.exe
      "C:\Users\Admin\AppData\Local\Temp\941ffbcc54a5826dde6e2d35f2fc761d.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1060-2-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1060-7-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2640-1-0x0000000000100000-0x0000000000102000-memory.dmp

    Filesize

    8KB

  • memory/2640-0-0x0000000000940000-0x0000000000946000-memory.dmp

    Filesize

    24KB