blustealer | 738a485429af982afe764c392327ad1940bc0e2c53e46ccebc7e7528abaa9c9d

Analysis

max time kernel
85s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2024 23:42

Target

9ee21b7bda8668d0a5e41273d0ce1291.exe
Size

735KB
MD5

9ee21b7bda8668d0a5e41273d0ce1291
SHA1

bcd0969fa8441be09d256585a7bd7073d2725f59
SHA256

738a485429af982afe764c392327ad1940bc0e2c53e46ccebc7e7528abaa9c9d
SHA512

eff01ac098513e9a74dc75e6fa58f47dc51ad951d3667d1378eecc029c8378e7a386b6e2f8cf32d7b4be75b4ac90a6be8214751a4935da6e24d80315ee0ef6f1
SSDEEP

12288:r7T2OCm5I7wjmyGR7GjOzv1S87j4HtkqYrp9yo0BNhc96DH/ofO/oKc:r7T2OCjkjmykyjOhH4HOqspDQ9X/M

Score

10^/10

Family

blustealer

https://api.telegram.org/bot1838876767:AAEiDKTcT_A4WBwpMo9nnrtBP7OvsmEUnNU/sendMessage?chat_id=1300181783

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4556 set thread context of 2368	4556	9ee21b7bda8668d0a5e41273d0ce1291.exe	87

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4556	9ee21b7bda8668d0a5e41273d0ce1291.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2368	9ee21b7bda8668d0a5e41273d0ce1291.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 2368	4556	9ee21b7bda8668d0a5e41273d0ce1291.exe	87
PID 4556 wrote to memory of 2368	4556	9ee21b7bda8668d0a5e41273d0ce1291.exe	87
PID 4556 wrote to memory of 2368	4556	9ee21b7bda8668d0a5e41273d0ce1291.exe	87
PID 4556 wrote to memory of 2368	4556	9ee21b7bda8668d0a5e41273d0ce1291.exe	87

C:\Users\Admin\AppData\Local\Temp\9ee21b7bda8668d0a5e41273d0ce1291.exe
"C:\Users\Admin\AppData\Local\Temp\9ee21b7bda8668d0a5e41273d0ce1291.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\9ee21b7bda8668d0a5e41273d0ce1291.exe
  "C:\Users\Admin\AppData\Local\Temp\9ee21b7bda8668d0a5e41273d0ce1291.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2368

memory/2368-3-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2368-5-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2368-8-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4556-2-0x0000000002CB0000-0x0000000002CB2000-memory.dmp

Filesize
8KB

Download
memory/4556-1-0x0000000000E00000-0x0000000000F00000-memory.dmp

Filesize
1024KB

Download