blustealer | 731cea3715ba1107c3ed9333a556736dc6d710f22de531bc4cbcb9af9b1a2f0e

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
16-02-2024 00:32

Target

9ef9bddf86918a7458905a441643a8ad.exe
Size

1.3MB
MD5

9ef9bddf86918a7458905a441643a8ad
SHA1

416016254438b55e96f25a775ee53202fce790cf
SHA256

731cea3715ba1107c3ed9333a556736dc6d710f22de531bc4cbcb9af9b1a2f0e
SHA512

e44974106d2144238071957e0e9e3457f291e243febb71532e0b5ecae8dc759140d52950cd564e49b5f4c0f7c6987242ef176dba4664414eca0ce67735b1c625
SSDEEP

24576:fEpGAWfNaleWllK9Ua3IUhIMUB2CoHzvTzwsdksiYeOgPP6B:4jW8lzl0vIUhIM2GHEXYetP6B

Score

10^/10

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2164 set thread context of 2156	2164	9ef9bddf86918a7458905a441643a8ad.exe	28

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2164	9ef9bddf86918a7458905a441643a8ad.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2156	2164	9ef9bddf86918a7458905a441643a8ad.exe	28
PID 2164 wrote to memory of 2156	2164	9ef9bddf86918a7458905a441643a8ad.exe	28
PID 2164 wrote to memory of 2156	2164	9ef9bddf86918a7458905a441643a8ad.exe	28
PID 2164 wrote to memory of 2156	2164	9ef9bddf86918a7458905a441643a8ad.exe	28
PID 2164 wrote to memory of 2156	2164	9ef9bddf86918a7458905a441643a8ad.exe	28

C:\Users\Admin\AppData\Local\Temp\9ef9bddf86918a7458905a441643a8ad.exe
"C:\Users\Admin\AppData\Local\Temp\9ef9bddf86918a7458905a441643a8ad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\9ef9bddf86918a7458905a441643a8ad.exe"
  2⤵
  PID:2156

memory/2156-3-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/2164-1-0x0000000000090000-0x0000000000190000-memory.dmp

Filesize
1024KB

Download
memory/2164-2-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download