blustealer | d5e262331262d0925aaa1e5c601e41f82a6795275067e44e7bef7624db0f0b48

Analysis

max time kernel
152s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-03-2024 09:11

Target

d3218551c9be855f8bff76c38536a454.exe
Size

2.6MB
MD5

d3218551c9be855f8bff76c38536a454
SHA1

a43a9bfb82106644719211b93512d3adbbd00e6c
SHA256

d5e262331262d0925aaa1e5c601e41f82a6795275067e44e7bef7624db0f0b48
SHA512

c471a9ae459eda97dce8b40dca6022b61ca124a89d7ec18d85c36a14c4c13fd1cd18a39c5f9782c0e4b4d0ee3f91884f25987347a358166ccd9d544ea3748de5
SSDEEP

24576:O3t/5Fixhtf5HxoPpGQrH0yUxnNnmtA7tuWxGFYCOAzlUsUtsmr7O:KFQ2+Xn2PoGFm77

Score

10^/10

Family

blustealer

https://api.telegram.org/bot1949235546:AAFJ8hWHynuHinrzOjcAE-TQlS6bYGcf8J8/sendMessage?chat_id=1947722068

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/4892-9-0x0000000003360000-0x0000000003376000-memory.dmp	family_zgrat_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4892 set thread context of 4016	4892	d3218551c9be855f8bff76c38536a454.exe	100

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4016	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 4016	4892	d3218551c9be855f8bff76c38536a454.exe	100
PID 4892 wrote to memory of 4016	4892	d3218551c9be855f8bff76c38536a454.exe	100
PID 4892 wrote to memory of 4016	4892	d3218551c9be855f8bff76c38536a454.exe	100
PID 4892 wrote to memory of 4016	4892	d3218551c9be855f8bff76c38536a454.exe	100
PID 4892 wrote to memory of 4016	4892	d3218551c9be855f8bff76c38536a454.exe	100
PID 4892 wrote to memory of 4016	4892	d3218551c9be855f8bff76c38536a454.exe	100
PID 4892 wrote to memory of 4016	4892	d3218551c9be855f8bff76c38536a454.exe	100
PID 4892 wrote to memory of 4016	4892	d3218551c9be855f8bff76c38536a454.exe	100

C:\Users\Admin\AppData\Local\Temp\d3218551c9be855f8bff76c38536a454.exe
"C:\Users\Admin\AppData\Local\Temp\d3218551c9be855f8bff76c38536a454.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:1328

memory/4016-10-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4016-17-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4016-13-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4892-6-0x00000000034A0000-0x00000000034B0000-memory.dmp

Filesize
64KB

Download
memory/4892-4-0x0000000005A50000-0x0000000005AC6000-memory.dmp

Filesize
472KB

Download
memory/4892-5-0x0000000005B00000-0x0000000005B9C000-memory.dmp

Filesize
624KB

Download
memory/4892-0-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4892-7-0x0000000005950000-0x000000000596E000-memory.dmp

Filesize
120KB

Download
memory/4892-8-0x0000000005C30000-0x0000000005DAA000-memory.dmp

Filesize
1.5MB

Download
memory/4892-9-0x0000000003360000-0x0000000003376000-memory.dmp

Filesize
88KB

Download
memory/4892-3-0x00000000059B0000-0x0000000005A42000-memory.dmp

Filesize
584KB

Download
memory/4892-14-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4892-2-0x00000000060B0000-0x0000000006654000-memory.dmp

Filesize
5.6MB

Download
memory/4892-1-0x0000000000CD0000-0x0000000000F74000-memory.dmp

Filesize
2.6MB

Download