blustealer | 1d0e997a1e0cca7446644a5082da18ea191862c85a3e222b0296bdb158c2a387

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/gyyrofsvwt.dll
Size 30KB
Sample240404-bm1tfaag65
SHA256 f5b07baf233029ae6a86a512fd84161c07d27827ef0222eea9783296249f646b
MD5 593ae51744a3a1518c88249d88f6e0d8
SHA1 799fc91d7871e4387fd487da8c066a5908263088
SHA512 91d538a964f803b97b5983ca7bfab265cbfca1d481c9da7038d478bef56cea033cd9fc7acaf18b5a9680fb684cacab950df66fc9b4264ba8b5ed63c56e80cf6a
SSDEEP 384:qXR1YCNE0PHVORyEN1EzzSO4A37//YriYpYz83wolkxZP8Zi9Gsn9/0VlFaCu5Qi:qB1jE0NORy+O4Y7Hw/pUoksZeG+9/MA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blustealer stealer

Malware Config

Extracted

Family

blustealer

https://api.telegram.org/bot1838876767:AAEiDKTcT_A4WBwpMo9nnrtBP7OvsmEUnNU/sendMessage?chat_id=1300181783

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2060 set thread context of 2712	2060	rundll32.exe	29

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2712	rundll32.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2060	1924	rundll32.exe	28
PID 1924 wrote to memory of 2060	1924	rundll32.exe	28
PID 1924 wrote to memory of 2060	1924	rundll32.exe	28
PID 1924 wrote to memory of 2060	1924	rundll32.exe	28
PID 1924 wrote to memory of 2060	1924	rundll32.exe	28
PID 1924 wrote to memory of 2060	1924	rundll32.exe	28
PID 1924 wrote to memory of 2060	1924	rundll32.exe	28
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gyyrofsvwt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gyyrofsvwt.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gyyrofsvwt.dll,#1
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2060-0-0x00000000751B0000-0x00000000751BC000-memory.dmp

Download

memory/2060-1-0x0000000075190000-0x000000007519C000-memory.dmp

Download

memory/2060-2-0x00000000751A0000-0x00000000751AC000-memory.dmp

Download

memory/2060-3-0x0000000075190000-0x000000007519C000-memory.dmp

Download

memory/2060-8-0x00000000751A0000-0x00000000751AC000-memory.dmp

Download

memory/2060-7-0x0000000075190000-0x000000007519C000-memory.dmp

Download

memory/2060-5-0x00000000751B0000-0x00000000751B7000-memory.dmp

Download

memory/2712-4-0x0000000000400000-0x0000000000504000-memory.dmp

Download

memory/2712-9-0x0000000000400000-0x0000000000504000-memory.dmp

Download

memory/2712-12-0x0000000000400000-0x0000000000504000-memory.dmp

Download

memory/2712-13-0x0000000000400000-0x0000000000504000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads