blustealer | 8fb7d7c33173d49da7907bf7bec5eea3d7d7f79ea3fef39bedf3de4b22f76987

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09-03-2024 22:55

Target

bd047836bb8805934054d02d6d4263f6.exe
Size

512KB
MD5

bd047836bb8805934054d02d6d4263f6
SHA1

235a213a7bb4fc944199ec54a04138c0c4d0150d
SHA256

8fb7d7c33173d49da7907bf7bec5eea3d7d7f79ea3fef39bedf3de4b22f76987
SHA512

532c65ddde7cac5d06ce54283f62625783082d2c186f24246ed24d32334a1cf0adb1e489ef027308b76c2620b8565c735a5a2d3ec0b67f4e845d91ea4e1ba634
SSDEEP

12288:TKhCCCCCCCCCCCCC1g5al+tpTQTujAyfiIsdCCCCCCCCCCCCCCCCCCC/c2XvB5+5:TKnfSIT+L4M6U/QjortrtmHTdSqBV+

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2548 set thread context of 1828	2548	bd047836bb8805934054d02d6d4263f6.exe	29

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2548	bd047836bb8805934054d02d6d4263f6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1828	bd047836bb8805934054d02d6d4263f6.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 1828	2548	bd047836bb8805934054d02d6d4263f6.exe	29
PID 2548 wrote to memory of 1828	2548	bd047836bb8805934054d02d6d4263f6.exe	29
PID 2548 wrote to memory of 1828	2548	bd047836bb8805934054d02d6d4263f6.exe	29
PID 2548 wrote to memory of 1828	2548	bd047836bb8805934054d02d6d4263f6.exe	29
PID 2548 wrote to memory of 1828	2548	bd047836bb8805934054d02d6d4263f6.exe	29

C:\Users\Admin\AppData\Local\Temp\bd047836bb8805934054d02d6d4263f6.exe
"C:\Users\Admin\AppData\Local\Temp\bd047836bb8805934054d02d6d4263f6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Local\Temp\bd047836bb8805934054d02d6d4263f6.exe
  "C:\Users\Admin\AppData\Local\Temp\bd047836bb8805934054d02d6d4263f6.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1828

memory/1828-2-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1828-4-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1828-7-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1828-8-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/2548-0-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2548-1-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download