blustealer | 6f166bd961214455803a5d9656fc2a70837df425936a87ed0f88bd58a06b3be9

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2024 12:36

Target

9971813b73d9822149d699f592f7d958.exe
Size

2.6MB
MD5

9971813b73d9822149d699f592f7d958
SHA1

79d1b057a523addc7adc4d305d4df54d35cd923b
SHA256

6f166bd961214455803a5d9656fc2a70837df425936a87ed0f88bd58a06b3be9
SHA512

6559c25827037f9a6550f2c5582eca563c167fee4c2a63150210c81b3834f249270f15dd7938028e2d21a095ceba8588223394179053c024ff83d6ef07f128cf
SSDEEP

24576:5yvaeTFag6WbUonU6ZJOlbWfwnHVPi9QBTZdIauBhHv5ZGMAJ0PHJi:svavh76ByQmlIRPXA

Score

10^/10

Family

blustealer

https://api.telegram.org/bot1943133814:AAGel7Cna1V4ds4YJL4kPgVVqKEmYV09C7I/sendMessage?chat_id=1518974695

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/3992-9-0x00000000026E0000-0x00000000026F6000-memory.dmp	family_zgrat_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3992 set thread context of 1956	3992	9971813b73d9822149d699f592f7d958.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1956	9971813b73d9822149d699f592f7d958.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 1956	3992	9971813b73d9822149d699f592f7d958.exe	84
PID 3992 wrote to memory of 1956	3992	9971813b73d9822149d699f592f7d958.exe	84
PID 3992 wrote to memory of 1956	3992	9971813b73d9822149d699f592f7d958.exe	84
PID 3992 wrote to memory of 1956	3992	9971813b73d9822149d699f592f7d958.exe	84
PID 3992 wrote to memory of 1956	3992	9971813b73d9822149d699f592f7d958.exe	84
PID 3992 wrote to memory of 1956	3992	9971813b73d9822149d699f592f7d958.exe	84
PID 3992 wrote to memory of 1956	3992	9971813b73d9822149d699f592f7d958.exe	84
PID 3992 wrote to memory of 1956	3992	9971813b73d9822149d699f592f7d958.exe	84

C:\Users\Admin\AppData\Local\Temp\9971813b73d9822149d699f592f7d958.exe
"C:\Users\Admin\AppData\Local\Temp\9971813b73d9822149d699f592f7d958.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Users\Admin\AppData\Local\Temp\9971813b73d9822149d699f592f7d958.exe
  "C:\Users\Admin\AppData\Local\Temp\9971813b73d9822149d699f592f7d958.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1956

memory/1956-10-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1956-16-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1956-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3992-6-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/3992-4-0x0000000004E20000-0x0000000004E96000-memory.dmp

Filesize
472KB

Download
memory/3992-5-0x0000000004F40000-0x0000000004FDC000-memory.dmp

Filesize
624KB

Download
memory/3992-0-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/3992-7-0x0000000004D40000-0x0000000004D5E000-memory.dmp

Filesize
120KB

Download
memory/3992-8-0x0000000004FE0000-0x0000000005156000-memory.dmp

Filesize
1.5MB

Download
memory/3992-9-0x00000000026E0000-0x00000000026F6000-memory.dmp

Filesize
88KB

Download
memory/3992-3-0x0000000004CA0000-0x0000000004D32000-memory.dmp

Filesize
584KB

Download
memory/3992-2-0x0000000005350000-0x00000000058F4000-memory.dmp

Filesize
5.6MB

Download
memory/3992-1-0x0000000000020000-0x00000000002C6000-memory.dmp

Filesize
2.6MB

Download
memory/3992-17-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download