blustealer | 1d0e997a1e0cca7446644a5082da18ea191862c85a3e222b0296bdb158c2a387

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-04-2024 01:16

Target

$PLUGINSDIR/gyyrofsvwt.dll
Size

30KB
MD5

593ae51744a3a1518c88249d88f6e0d8
SHA1

799fc91d7871e4387fd487da8c066a5908263088
SHA256

f5b07baf233029ae6a86a512fd84161c07d27827ef0222eea9783296249f646b
SHA512

91d538a964f803b97b5983ca7bfab265cbfca1d481c9da7038d478bef56cea033cd9fc7acaf18b5a9680fb684cacab950df66fc9b4264ba8b5ed63c56e80cf6a
SSDEEP

384:qXR1YCNE0PHVORyEN1EzzSO4A37//YriYpYz83wolkxZP8Zi9Gsn9/0VlFaCu5Qi:qB1jE0NORy+O4Y7Hw/pUoksZeG+9/MA

Score

10^/10

Family

blustealer

https://api.telegram.org/bot1838876767:AAEiDKTcT_A4WBwpMo9nnrtBP7OvsmEUnNU/sendMessage?chat_id=1300181783

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2060 set thread context of 2712	2060	rundll32.exe	29

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2712	rundll32.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2060	1924	rundll32.exe	28
PID 1924 wrote to memory of 2060	1924	rundll32.exe	28
PID 1924 wrote to memory of 2060	1924	rundll32.exe	28
PID 1924 wrote to memory of 2060	1924	rundll32.exe	28
PID 1924 wrote to memory of 2060	1924	rundll32.exe	28
PID 1924 wrote to memory of 2060	1924	rundll32.exe	28
PID 1924 wrote to memory of 2060	1924	rundll32.exe	28
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29
PID 2060 wrote to memory of 2712	2060	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gyyrofsvwt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gyyrofsvwt.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gyyrofsvwt.dll,#1
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2712

memory/2060-0-0x00000000751B0000-0x00000000751BC000-memory.dmp

Filesize
48KB

Download
memory/2060-1-0x0000000075190000-0x000000007519C000-memory.dmp

Filesize
48KB

Download
memory/2060-2-0x00000000751A0000-0x00000000751AC000-memory.dmp

Filesize
48KB

Download
memory/2060-3-0x0000000075190000-0x000000007519C000-memory.dmp

Filesize
48KB

Download
memory/2060-8-0x00000000751A0000-0x00000000751AC000-memory.dmp

Filesize
48KB

Download
memory/2060-7-0x0000000075190000-0x000000007519C000-memory.dmp

Filesize
48KB

Download
memory/2060-5-0x00000000751B0000-0x00000000751B7000-memory.dmp

Filesize
28KB

Download
memory/2712-4-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download
memory/2712-9-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download
memory/2712-12-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download
memory/2712-13-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download