blustealer | 6c61d18fadb92cf6235f0d9f708f876f8b8bcaaa6eb7d66d5ed515a60a317d94

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-02-2024 09:29

Target

9d8bd1a80acd712dc10e174cbdad8daa.exe
Size

486KB
MD5

9d8bd1a80acd712dc10e174cbdad8daa
SHA1

94941990af9a90fc27369e4bf4a1a82e11c536c7
SHA256

6c61d18fadb92cf6235f0d9f708f876f8b8bcaaa6eb7d66d5ed515a60a317d94
SHA512

fa0d8b11d168ec835b483e9ff636e16dc9a71b3df2502d4e1e7bc2880c38cb745d3deef2dbe08ed4d1439bd34a5e835bfcf8bd0893689fa6130eb10404ce3284
SSDEEP

12288:WCYl8CEyYIa2K1jePyf5DNjleenYXacCEwi1lyFZj:WCYlF5HnKSKDvLnYXrpwxFZj

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1996 set thread context of 2208	1996	9d8bd1a80acd712dc10e174cbdad8daa.exe	29

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1996	9d8bd1a80acd712dc10e174cbdad8daa.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2208	9d8bd1a80acd712dc10e174cbdad8daa.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2208	1996	9d8bd1a80acd712dc10e174cbdad8daa.exe	29
PID 1996 wrote to memory of 2208	1996	9d8bd1a80acd712dc10e174cbdad8daa.exe	29
PID 1996 wrote to memory of 2208	1996	9d8bd1a80acd712dc10e174cbdad8daa.exe	29
PID 1996 wrote to memory of 2208	1996	9d8bd1a80acd712dc10e174cbdad8daa.exe	29
PID 1996 wrote to memory of 2208	1996	9d8bd1a80acd712dc10e174cbdad8daa.exe	29

C:\Users\Admin\AppData\Local\Temp\9d8bd1a80acd712dc10e174cbdad8daa.exe
"C:\Users\Admin\AppData\Local\Temp\9d8bd1a80acd712dc10e174cbdad8daa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\9d8bd1a80acd712dc10e174cbdad8daa.exe
  "C:\Users\Admin\AppData\Local\Temp\9d8bd1a80acd712dc10e174cbdad8daa.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2208

memory/1996-1-0x0000000000090000-0x0000000000092000-memory.dmp

Filesize
8KB

Download
memory/1996-0-0x0000000000EC0000-0x0000000000EC6000-memory.dmp

Filesize
24KB

Download
memory/2208-2-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2208-7-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2208-8-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download