blustealer | 6c61d18fadb92cf6235f0d9f708f876f8b8bcaaa6eb7d66d5ed515a60a317d94

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2024 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d8bd1a80acd712dc10e174cbdad8daa.exe
Size

486KB
MD5

9d8bd1a80acd712dc10e174cbdad8daa
SHA1

94941990af9a90fc27369e4bf4a1a82e11c536c7
SHA256

6c61d18fadb92cf6235f0d9f708f876f8b8bcaaa6eb7d66d5ed515a60a317d94
SHA512

fa0d8b11d168ec835b483e9ff636e16dc9a71b3df2502d4e1e7bc2880c38cb745d3deef2dbe08ed4d1439bd34a5e835bfcf8bd0893689fa6130eb10404ce3284
SSDEEP

12288:WCYl8CEyYIa2K1jePyf5DNjleenYXacCEwi1lyFZj:WCYlF5HnKSKDvLnYXrpwxFZj

Score

10^/10

blustealer stealer

Malware Config

Extracted

Family

blustealer

Credentials

Protocol: smtp
Host:
mail.dm-teh.com
Port:
587
Username:
[email protected]
Password:
Vm@(O;CO.vEQ

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1044 set thread context of 3328	1044	9d8bd1a80acd712dc10e174cbdad8daa.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4384	1044	WerFault.exe	86

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1044	9d8bd1a80acd712dc10e174cbdad8daa.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3328	9d8bd1a80acd712dc10e174cbdad8daa.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 3328	1044	9d8bd1a80acd712dc10e174cbdad8daa.exe	88
PID 1044 wrote to memory of 3328	1044	9d8bd1a80acd712dc10e174cbdad8daa.exe	88
PID 1044 wrote to memory of 3328	1044	9d8bd1a80acd712dc10e174cbdad8daa.exe	88
PID 1044 wrote to memory of 3328	1044	9d8bd1a80acd712dc10e174cbdad8daa.exe	88

C:\Users\Admin\AppData\Local\Temp\9d8bd1a80acd712dc10e174cbdad8daa.exe
"C:\Users\Admin\AppData\Local\Temp\9d8bd1a80acd712dc10e174cbdad8daa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Local\Temp\9d8bd1a80acd712dc10e174cbdad8daa.exe
  "C:\Users\Admin\AppData\Local\Temp\9d8bd1a80acd712dc10e174cbdad8daa.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 312
  2⤵
  - Program crash
  PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 1044 -ip 1044
1⤵
PID:4820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-0-0x0000000000F40000-0x0000000000F46000-memory.dmp

Filesize
24KB

Download
memory/1044-1-0x00000000010E0000-0x00000000010E2000-memory.dmp

Filesize
8KB

Download
memory/3328-2-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3328-4-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3328-7-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download