Analysis

  • max time kernel
    131s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06-03-2024 02:26

General

  • Target

    b646ed8897b9acfa44fe77005f445049.exe

  • Size

    908KB

  • MD5

    b646ed8897b9acfa44fe77005f445049

  • SHA1

    59b23e3d3e4bf960fba68f400a6b813e2487b363

  • SHA256

    cb5bc89cd1ed26277efef096f0db68a21d74e301e866e7bb14fb0c1207cd64eb

  • SHA512

    b413f3da7bc500f051df4f58e91b9e5dbb77319985ad181eda93420d4f84af95352bd12eda390561414ad023a1b7727162a84be1a68dea6d6ade73d0ceefbc20

  • SSDEEP

    12288:waLJUieifF9KBS/grsuM4gABESnZdInHDLh8ivkj2W1MW0gju:9Vd/KBUgrsuMGjdInJ8cW1

Score
10/10

Malware Config

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b646ed8897b9acfa44fe77005f445049.exe
    "C:\Users\Admin\AppData\Local\Temp\b646ed8897b9acfa44fe77005f445049.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2328
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:1364

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1364-5-0x0000000000090000-0x000000000010A000-memory.dmp

      Filesize

      488KB

    • memory/1364-7-0x0000000000090000-0x000000000010A000-memory.dmp

      Filesize

      488KB

    • memory/1364-9-0x0000000000090000-0x000000000010A000-memory.dmp

      Filesize

      488KB

    • memory/1364-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1364-15-0x0000000000090000-0x000000000010A000-memory.dmp

      Filesize

      488KB

    • memory/2328-0-0x00000000013C0000-0x00000000014A8000-memory.dmp

      Filesize

      928KB

    • memory/2328-1-0x00000000743F0000-0x0000000074ADE000-memory.dmp

      Filesize

      6.9MB

    • memory/2328-2-0x0000000004E80000-0x0000000004EC0000-memory.dmp

      Filesize

      256KB

    • memory/2328-3-0x00000000743F0000-0x0000000074ADE000-memory.dmp

      Filesize

      6.9MB

    • memory/2328-4-0x0000000004E80000-0x0000000004EC0000-memory.dmp

      Filesize

      256KB