blustealer | 731cea3715ba1107c3ed9333a556736dc6d710f22de531bc4cbcb9af9b1a2f0e

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16-02-2024 00:32

Target

9ef9bddf86918a7458905a441643a8ad.exe
Size

1.3MB
MD5

9ef9bddf86918a7458905a441643a8ad
SHA1

416016254438b55e96f25a775ee53202fce790cf
SHA256

731cea3715ba1107c3ed9333a556736dc6d710f22de531bc4cbcb9af9b1a2f0e
SHA512

e44974106d2144238071957e0e9e3457f291e243febb71532e0b5ecae8dc759140d52950cd564e49b5f4c0f7c6987242ef176dba4664414eca0ce67735b1c625
SSDEEP

24576:fEpGAWfNaleWllK9Ua3IUhIMUB2CoHzvTzwsdksiYeOgPP6B:4jW8lzl0vIUhIM2GHEXYetP6B

Score

10^/10

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3660 set thread context of 4528	3660	9ef9bddf86918a7458905a441643a8ad.exe	85

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3660	9ef9bddf86918a7458905a441643a8ad.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4528	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 4528	3660	9ef9bddf86918a7458905a441643a8ad.exe	85
PID 3660 wrote to memory of 4528	3660	9ef9bddf86918a7458905a441643a8ad.exe	85
PID 3660 wrote to memory of 4528	3660	9ef9bddf86918a7458905a441643a8ad.exe	85
PID 3660 wrote to memory of 4528	3660	9ef9bddf86918a7458905a441643a8ad.exe	85

C:\Users\Admin\AppData\Local\Temp\9ef9bddf86918a7458905a441643a8ad.exe
"C:\Users\Admin\AppData\Local\Temp\9ef9bddf86918a7458905a441643a8ad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\9ef9bddf86918a7458905a441643a8ad.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4528

memory/3660-2-0x0000000000560000-0x0000000000562000-memory.dmp

Filesize
8KB

Download
memory/3660-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download
memory/4528-3-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/4528-5-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/4528-8-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download