stealc | 52a28a239e77e186ed692f6fcb64672b5861de1e58766698bfcb0def94b25685

Analysis

max time kernel
64s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2023, 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edf4eeeda837f602de4610bdd2880f04e98164e2029993b411215125f38a5208.exe
Size

277KB
MD5

9328c4d5cb866807b9dc37ac77c07507
SHA1

873e7da03a3665156e455e43140ef2b76d931b80
SHA256

edf4eeeda837f602de4610bdd2880f04e98164e2029993b411215125f38a5208
SHA512

8aa4cbf86579ac0e10c7c22d39634e31d910bd1ba054fa6c24e8819c34aedc29512b71f87dd5c5c1269138433bee822a5953028a9a8aa30bfb829627c052ce2f
SSDEEP

3072:HoLvVW2lhwh3qvLCUqEt83/rRkZuu1NiJPdiVhIj3nj0WbaoMiWN8aeDr:I70gw2N83/TfVMh2T0WbaoMiva

Score

10^/10

stealc discovery stealer

Malware Config

Extracted

Family

stealc

http://michaeljohnson.top/410b5129171f10ea.php

Signatures

Detects Stealc stealer 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/2772-135-0x0000000000400000-0x0000000002B72000-memory.dmp	family_stealc

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4628	2772	WerFault.exe	83

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	edf4eeeda837f602de4610bdd2880f04e98164e2029993b411215125f38a5208.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	edf4eeeda837f602de4610bdd2880f04e98164e2029993b411215125f38a5208.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2772	edf4eeeda837f602de4610bdd2880f04e98164e2029993b411215125f38a5208.exe
2772	edf4eeeda837f602de4610bdd2880f04e98164e2029993b411215125f38a5208.exe

C:\Users\Admin\AppData\Local\Temp\edf4eeeda837f602de4610bdd2880f04e98164e2029993b411215125f38a5208.exe
"C:\Users\Admin\AppData\Local\Temp\edf4eeeda837f602de4610bdd2880f04e98164e2029993b411215125f38a5208.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 1292
  2⤵
  - Program crash
  PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2772 -ip 2772
1⤵
PID:2072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2772-134-0x0000000002CD0000-0x0000000002CE5000-memory.dmp

Filesize
84KB

Download
memory/2772-135-0x0000000000400000-0x0000000002B72000-memory.dmp

Filesize
39.4MB

Download