blustealer | ff5ec2c1351e835e479f1d02f65722274f6d07d26a82ae14d6d01a859b41248a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20-03-2024 06:57

Target

d82a5a3a213d381f1a8975148713994e.exe
Size

489KB
MD5

d82a5a3a213d381f1a8975148713994e
SHA1

0bd310364b8ab6b44bfe8624505592a8f1d0e1d5
SHA256

ff5ec2c1351e835e479f1d02f65722274f6d07d26a82ae14d6d01a859b41248a
SHA512

3bbd4697db01fcf5cae99e574a5d3f0f089dee8a18fd64fe41441bb8cce65f95f8f5c60432dd99b34d27ed9b452f30e10079b76caa3d38214980ee45df98988b
SSDEEP

12288:wAEGG7mC+J8x2JM/TlxUYUvilkw1lToXQlfoDGxq92h3kcdOdALZ4:0tz0K2JM/ThUvo1lToXEADJ03rd6AL+

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2916 set thread context of 2172	2916	d82a5a3a213d381f1a8975148713994e.exe	29

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2916	d82a5a3a213d381f1a8975148713994e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2172	d82a5a3a213d381f1a8975148713994e.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2172	2916	d82a5a3a213d381f1a8975148713994e.exe	29
PID 2916 wrote to memory of 2172	2916	d82a5a3a213d381f1a8975148713994e.exe	29
PID 2916 wrote to memory of 2172	2916	d82a5a3a213d381f1a8975148713994e.exe	29
PID 2916 wrote to memory of 2172	2916	d82a5a3a213d381f1a8975148713994e.exe	29
PID 2916 wrote to memory of 2172	2916	d82a5a3a213d381f1a8975148713994e.exe	29

C:\Users\Admin\AppData\Local\Temp\d82a5a3a213d381f1a8975148713994e.exe
"C:\Users\Admin\AppData\Local\Temp\d82a5a3a213d381f1a8975148713994e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\d82a5a3a213d381f1a8975148713994e.exe
  "C:\Users\Admin\AppData\Local\Temp\d82a5a3a213d381f1a8975148713994e.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2172

memory/2172-2-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2172-7-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2172-8-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2916-0-0x0000000000DA0000-0x0000000000DA6000-memory.dmp

Filesize
24KB

Download
memory/2916-1-0x0000000000100000-0x0000000000102000-memory.dmp

Filesize
8KB

Download