blustealer | 95ae532a3078fcb5d6541ab5789497e4cf3919ee5fbb09f33af55ac763280641

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 16:18

Target

df95aae6381d28eb50962bffde872747.exe
Size

505KB
MD5

df95aae6381d28eb50962bffde872747
SHA1

4e6b4bbabc63f1cb5b0704d00d93defd9c464ca8
SHA256

95ae532a3078fcb5d6541ab5789497e4cf3919ee5fbb09f33af55ac763280641
SHA512

1701237f9312aeece6dbfe37be25daca8bb7a63cd94f983abb14d703e440f5d40e19aba9daccc3812b0dd842df1cdaef6a2053c1d9d201a57dc8df58e22c54ef
SSDEEP

12288:Sp7a5IxyWpnNQ5nucJZn7yJrz9WLu/h6P/Y2aw29wkhAvIj1robqeFhcl9p:e7a5IxnkuAECPb/k3joF2lz

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1728 set thread context of 2280	1728	df95aae6381d28eb50962bffde872747.exe	28

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1728	df95aae6381d28eb50962bffde872747.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2280	df95aae6381d28eb50962bffde872747.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2280	1728	df95aae6381d28eb50962bffde872747.exe	28
PID 1728 wrote to memory of 2280	1728	df95aae6381d28eb50962bffde872747.exe	28
PID 1728 wrote to memory of 2280	1728	df95aae6381d28eb50962bffde872747.exe	28
PID 1728 wrote to memory of 2280	1728	df95aae6381d28eb50962bffde872747.exe	28
PID 1728 wrote to memory of 2280	1728	df95aae6381d28eb50962bffde872747.exe	28

C:\Users\Admin\AppData\Local\Temp\df95aae6381d28eb50962bffde872747.exe
"C:\Users\Admin\AppData\Local\Temp\df95aae6381d28eb50962bffde872747.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\df95aae6381d28eb50962bffde872747.exe
  "C:\Users\Admin\AppData\Local\Temp\df95aae6381d28eb50962bffde872747.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2280

memory/1728-1-0x0000000000280000-0x0000000000380000-memory.dmp

Filesize
1024KB

Download
memory/1728-2-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download
memory/2280-3-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2280-8-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download