blustealer | ff067dcb1df6837231a965295ce09eb39ddc7856b72f23c59f8bd950bcc8c3f8

Analysis

max time kernel
153s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 08:59

Target

dec7bbc61e5fac7b9dcc798e85c6cffc.exe
Size

2.6MB
MD5

dec7bbc61e5fac7b9dcc798e85c6cffc
SHA1

353315e4cf6cd85aa6cf574761f7b5e706b35597
SHA256

ff067dcb1df6837231a965295ce09eb39ddc7856b72f23c59f8bd950bcc8c3f8
SHA512

4edb7b2028045a70dc95ff3956904c19499f5442b87f402d7e3f8e0b861c0bb7e25ee906774d8a25e6ee92c428dad8db35881f401e426985e80914fb0129bbfa
SSDEEP

24576:lVe3u2JKwQ1rDRYgkCL9m9YgYXr0hLzwMTR3jllk+x0a2XQFsZxhoED:f9pqOyeMxlpYr

Score

10^/10

Family

blustealer

https://api.telegram.org/bot1949235546:AAFJ8hWHynuHinrzOjcAE-TQlS6bYGcf8J8/sendMessage?chat_id=1947722068

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/1160-9-0x0000000000F40000-0x0000000000F56000-memory.dmp	family_zgrat_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1160 set thread context of 2356	1160	dec7bbc61e5fac7b9dcc798e85c6cffc.exe	98

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2356	dec7bbc61e5fac7b9dcc798e85c6cffc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 2356	1160	dec7bbc61e5fac7b9dcc798e85c6cffc.exe	98
PID 1160 wrote to memory of 2356	1160	dec7bbc61e5fac7b9dcc798e85c6cffc.exe	98
PID 1160 wrote to memory of 2356	1160	dec7bbc61e5fac7b9dcc798e85c6cffc.exe	98
PID 1160 wrote to memory of 2356	1160	dec7bbc61e5fac7b9dcc798e85c6cffc.exe	98
PID 1160 wrote to memory of 2356	1160	dec7bbc61e5fac7b9dcc798e85c6cffc.exe	98
PID 1160 wrote to memory of 2356	1160	dec7bbc61e5fac7b9dcc798e85c6cffc.exe	98
PID 1160 wrote to memory of 2356	1160	dec7bbc61e5fac7b9dcc798e85c6cffc.exe	98
PID 1160 wrote to memory of 2356	1160	dec7bbc61e5fac7b9dcc798e85c6cffc.exe	98

C:\Users\Admin\AppData\Local\Temp\dec7bbc61e5fac7b9dcc798e85c6cffc.exe
"C:\Users\Admin\AppData\Local\Temp\dec7bbc61e5fac7b9dcc798e85c6cffc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Users\Admin\AppData\Local\Temp\dec7bbc61e5fac7b9dcc798e85c6cffc.exe
  "C:\Users\Admin\AppData\Local\Temp\dec7bbc61e5fac7b9dcc798e85c6cffc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2628 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:3632

memory/1160-6-0x0000000005310000-0x0000000005320000-memory.dmp

Filesize
64KB

Download
memory/1160-0-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/1160-2-0x0000000005480000-0x0000000005A24000-memory.dmp

Filesize
5.6MB

Download
memory/1160-3-0x0000000004F70000-0x0000000005002000-memory.dmp

Filesize
584KB

Download
memory/1160-4-0x0000000005010000-0x0000000005086000-memory.dmp

Filesize
472KB

Download
memory/1160-5-0x0000000005130000-0x00000000051CC000-memory.dmp

Filesize
624KB

Download
memory/1160-1-0x00000000002B0000-0x0000000000554000-memory.dmp

Filesize
2.6MB

Download
memory/1160-7-0x0000000004F30000-0x0000000004F4E000-memory.dmp

Filesize
120KB

Download
memory/1160-15-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/1160-9-0x0000000000F40000-0x0000000000F56000-memory.dmp

Filesize
88KB

Download
memory/1160-8-0x0000000005A30000-0x0000000005BAA000-memory.dmp

Filesize
1.5MB

Download
memory/2356-13-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2356-10-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2356-17-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download