blustealer | 3ece92463dcf24cb48108755946de3060883611669b3f54217e5600f06044883

Analysis

max time kernel
143s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 05:55

Target

baae7166db2043cb130b11250b1876fe.exe
Size

1.1MB
MD5

baae7166db2043cb130b11250b1876fe
SHA1

149ca24cd99231bbfa9b1802ace4912f648cd5b3
SHA256

3ece92463dcf24cb48108755946de3060883611669b3f54217e5600f06044883
SHA512

da23c754a84aab5bc0260d6c6e14536df897dd1db1cfb5749aec120c34d1ed31576386091bec51c38d63b2501a9a3f3403d4b527e3f5c703f437de03244171ac
SSDEEP

24576:FFWXykP5E3GkKJLqgam2UwVQCeYFC4W4:FFWXfoK1NamuQCecCF4

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3564 set thread context of 1772	3564	baae7166db2043cb130b11250b1876fe.exe	108

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1772	baae7166db2043cb130b11250b1876fe.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 1772	3564	baae7166db2043cb130b11250b1876fe.exe	108
PID 3564 wrote to memory of 1772	3564	baae7166db2043cb130b11250b1876fe.exe	108
PID 3564 wrote to memory of 1772	3564	baae7166db2043cb130b11250b1876fe.exe	108
PID 3564 wrote to memory of 1772	3564	baae7166db2043cb130b11250b1876fe.exe	108
PID 3564 wrote to memory of 1772	3564	baae7166db2043cb130b11250b1876fe.exe	108
PID 3564 wrote to memory of 1772	3564	baae7166db2043cb130b11250b1876fe.exe	108
PID 3564 wrote to memory of 1772	3564	baae7166db2043cb130b11250b1876fe.exe	108
PID 3564 wrote to memory of 1772	3564	baae7166db2043cb130b11250b1876fe.exe	108

C:\Users\Admin\AppData\Local\Temp\baae7166db2043cb130b11250b1876fe.exe
"C:\Users\Admin\AppData\Local\Temp\baae7166db2043cb130b11250b1876fe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\AppData\Local\Temp\baae7166db2043cb130b11250b1876fe.exe
  "C:\Users\Admin\AppData\Local\Temp\baae7166db2043cb130b11250b1876fe.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:1856

memory/1772-12-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1772-19-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1772-15-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/3564-4-0x00000000744E0000-0x0000000074C90000-memory.dmp

Filesize
7.7MB

Download
memory/3564-0-0x00000000744E0000-0x0000000074C90000-memory.dmp

Filesize
7.7MB

Download
memory/3564-5-0x0000000005800000-0x0000000005810000-memory.dmp

Filesize
64KB

Download
memory/3564-6-0x00000000057D0000-0x00000000057DA000-memory.dmp

Filesize
40KB

Download
memory/3564-7-0x0000000006230000-0x00000000062CC000-memory.dmp

Filesize
624KB

Download
memory/3564-8-0x0000000005910000-0x0000000005928000-memory.dmp

Filesize
96KB

Download
memory/3564-9-0x0000000005800000-0x0000000005810000-memory.dmp

Filesize
64KB

Download
memory/3564-10-0x0000000006660000-0x0000000006744000-memory.dmp

Filesize
912KB

Download
memory/3564-11-0x0000000008C70000-0x0000000008CE8000-memory.dmp

Filesize
480KB

Download
memory/3564-3-0x00000000055D0000-0x0000000005662000-memory.dmp

Filesize
584KB

Download
memory/3564-2-0x0000000005AE0000-0x0000000006084000-memory.dmp

Filesize
5.6MB

Download
memory/3564-18-0x00000000744E0000-0x0000000074C90000-memory.dmp

Filesize
7.7MB

Download
memory/3564-1-0x0000000000A90000-0x0000000000BAA000-memory.dmp

Filesize
1.1MB

Download