blustealer | ad9d1d2c8db7cc0b400cd49555dc39d2c0c13fa74784f007f5177163bf480176

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 18:33

Target

b5632339a5359f451b6ad0d68b2e6cb8.exe
Size

865KB
MD5

b5632339a5359f451b6ad0d68b2e6cb8
SHA1

bb37229b4be212a96773fcfa152ef9edacd9b203
SHA256

ad9d1d2c8db7cc0b400cd49555dc39d2c0c13fa74784f007f5177163bf480176
SHA512

93d73f2853038ba479e6fac47a9ebb0a9ec22a465a3ecaf3f1d002e51d3cf0dd1cc19d5e08c8c1ab46a5594e0138dce5ea513a41dbcecb64fb84513bfcc22da0
SSDEEP

24576:T9OTg+jR8EkHk9wZeDUJ5M5uClZXoVVmacP:kTgNE0ZiUJ5wZAVk

Score

10^/10

Family

blustealer

https://api.telegram.org/bot1816395306:AAE3ZBLYV2L9aT9mL8itL9vr3RP6nOz_B1o/sendMessage?chat_id=1368673464

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2084 set thread context of 2228	2084	b5632339a5359f451b6ad0d68b2e6cb8.exe	29

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2084	b5632339a5359f451b6ad0d68b2e6cb8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2228	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2228	2084	b5632339a5359f451b6ad0d68b2e6cb8.exe	29
PID 2084 wrote to memory of 2228	2084	b5632339a5359f451b6ad0d68b2e6cb8.exe	29
PID 2084 wrote to memory of 2228	2084	b5632339a5359f451b6ad0d68b2e6cb8.exe	29
PID 2084 wrote to memory of 2228	2084	b5632339a5359f451b6ad0d68b2e6cb8.exe	29
PID 2084 wrote to memory of 2228	2084	b5632339a5359f451b6ad0d68b2e6cb8.exe	29

C:\Users\Admin\AppData\Local\Temp\b5632339a5359f451b6ad0d68b2e6cb8.exe
"C:\Users\Admin\AppData\Local\Temp\b5632339a5359f451b6ad0d68b2e6cb8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\b5632339a5359f451b6ad0d68b2e6cb8.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2228

memory/2084-0-0x0000000001050000-0x0000000001072000-memory.dmp

Filesize
136KB

Download
memory/2084-1-0x0000000000100000-0x0000000000102000-memory.dmp

Filesize
8KB

Download
memory/2084-3-0x0000000001050000-0x0000000001072000-memory.dmp

Filesize
136KB

Download
memory/2228-2-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2228-5-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2228-8-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2228-9-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download