stealc | d38178bcf1349b6cf6f0a136e56065093ed7f97ef10f8324b3967d1e957a274c

Analysis

max time kernel
72s
max time network
70s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25/05/2023, 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

programsetup.exe
Size

3.5MB
MD5

53fb2627d1a83aa24541d5eef83a00b2
SHA1

08e5f2b40800f08c0427d45988fa617a4f1d7afe
SHA256

a38d41814b2eb62540eacd708033389c437f87f22d2561cbba21f542f43ed0d2
SHA512

c12749f62e4d742d7f18042a5a8b1a5eb8845a57da2dc0ed9e82320260747fd146420b6862632040a057f6ca7ac041b2812346d161c6ee550c2c9e26182b4a78
SSDEEP

49152:LyzsFHuAzxJgPUqariUo/ykNupCkqv7xPf0zyzF:

Score

10^/10

stealc persistence spyware stealer

Malware Config

Extracted

Family

stealc

http://5.42.64.88/cc18c73c655f48b7.php

Signatures

Detects Stealc stealer 1 IoCs

stealer

resource	yara_rule
behavioral19/memory/1700-146-0x0000000000400000-0x0000000000629000-memory.dmp	family_stealc

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Control Panel\International\Geo\Nation	programsetup.exe

Loads dropped DLL 2 IoCs

pid	Process
1700	InstallUtil.exe
1700	InstallUtil.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wjdyae = "\"C:\\Users\\Admin\\AppData\\Roaming\\Wekmxvxynso\\Wjdyae.exe\""	programsetup.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 928 set thread context of 1700	928	programsetup.exe	40

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallUtil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallUtil.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
112	timeout.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
612	ipconfig.exe
1992	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
588	powershell.exe
700	powershell.exe
928	programsetup.exe
1700	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	928	programsetup.exe
Token: SeDebugPrivilege	588	powershell.exe
Token: SeDebugPrivilege	700	powershell.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 572	928	programsetup.exe	28
PID 928 wrote to memory of 572	928	programsetup.exe	28
PID 928 wrote to memory of 572	928	programsetup.exe	28
PID 928 wrote to memory of 572	928	programsetup.exe	28
PID 572 wrote to memory of 612	572	cmd.exe	30
PID 572 wrote to memory of 612	572	cmd.exe	30
PID 572 wrote to memory of 612	572	cmd.exe	30
PID 572 wrote to memory of 612	572	cmd.exe	30
PID 928 wrote to memory of 588	928	programsetup.exe	31
PID 928 wrote to memory of 588	928	programsetup.exe	31
PID 928 wrote to memory of 588	928	programsetup.exe	31
PID 928 wrote to memory of 588	928	programsetup.exe	31
PID 928 wrote to memory of 1736	928	programsetup.exe	33
PID 928 wrote to memory of 1736	928	programsetup.exe	33
PID 928 wrote to memory of 1736	928	programsetup.exe	33
PID 928 wrote to memory of 1736	928	programsetup.exe	33
PID 1736 wrote to memory of 700	1736	cmd.exe	35
PID 1736 wrote to memory of 700	1736	cmd.exe	35
PID 1736 wrote to memory of 700	1736	cmd.exe	35
PID 1736 wrote to memory of 700	1736	cmd.exe	35
PID 928 wrote to memory of 428	928	programsetup.exe	36
PID 928 wrote to memory of 428	928	programsetup.exe	36
PID 928 wrote to memory of 428	928	programsetup.exe	36
PID 928 wrote to memory of 428	928	programsetup.exe	36
PID 428 wrote to memory of 1992	428	cmd.exe	38
PID 428 wrote to memory of 1992	428	cmd.exe	38
PID 428 wrote to memory of 1992	428	cmd.exe	38
PID 428 wrote to memory of 1992	428	cmd.exe	38
PID 928 wrote to memory of 1576	928	programsetup.exe	39
PID 928 wrote to memory of 1576	928	programsetup.exe	39
PID 928 wrote to memory of 1576	928	programsetup.exe	39
PID 928 wrote to memory of 1576	928	programsetup.exe	39
PID 928 wrote to memory of 1576	928	programsetup.exe	39
PID 928 wrote to memory of 1576	928	programsetup.exe	39
PID 928 wrote to memory of 1576	928	programsetup.exe	39
PID 928 wrote to memory of 1700	928	programsetup.exe	40
PID 928 wrote to memory of 1700	928	programsetup.exe	40
PID 928 wrote to memory of 1700	928	programsetup.exe	40
PID 928 wrote to memory of 1700	928	programsetup.exe	40
PID 928 wrote to memory of 1700	928	programsetup.exe	40
PID 928 wrote to memory of 1700	928	programsetup.exe	40
PID 928 wrote to memory of 1700	928	programsetup.exe	40
PID 928 wrote to memory of 1700	928	programsetup.exe	40
PID 928 wrote to memory of 1700	928	programsetup.exe	40
PID 928 wrote to memory of 1700	928	programsetup.exe	40
PID 928 wrote to memory of 1700	928	programsetup.exe	40
PID 928 wrote to memory of 1700	928	programsetup.exe	40
PID 1700 wrote to memory of 1696	1700	InstallUtil.exe	43
PID 1700 wrote to memory of 1696	1700	InstallUtil.exe	43
PID 1700 wrote to memory of 1696	1700	InstallUtil.exe	43
PID 1700 wrote to memory of 1696	1700	InstallUtil.exe	43
PID 1696 wrote to memory of 112	1696	cmd.exe	45
PID 1696 wrote to memory of 112	1696	cmd.exe	45
PID 1696 wrote to memory of 112	1696	cmd.exe	45
PID 1696 wrote to memory of 112	1696	cmd.exe	45

C:\Users\Admin\AppData\Local\Temp\programsetup.exe
"C:\Users\Admin\AppData\Local\Temp\programsetup.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ipconfig /release
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:612
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:588
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ipconfig /renew
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /renew
    3⤵
    - Gathers network information
    PID:1992
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  PID:1576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" & del "C:\ProgramData\*.dll"" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J2497QFFGE6ORJ2PBZ5Y.temp

Filesize
7KB

MD5
6439a221653fd6f43a25e8d73a1a8de9

SHA1
8611811b707114233498d32faa68a87ca98d2635

SHA256
f3e6eca4a9d1131cc2ce360690b75f2e094278fdbe3c4fbf91f8c9c5cd487860

SHA512
d06e4708f07913f067d302d051cd218e7c60ce8847bc1ac1735ee736ba87d08b05a89ad1146588936a9bdf220b9ebb02d725fab132fa58e464c23d0ac42c2cee

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
6439a221653fd6f43a25e8d73a1a8de9

SHA1
8611811b707114233498d32faa68a87ca98d2635

SHA256
f3e6eca4a9d1131cc2ce360690b75f2e094278fdbe3c4fbf91f8c9c5cd487860

SHA512
d06e4708f07913f067d302d051cd218e7c60ce8847bc1ac1735ee736ba87d08b05a89ad1146588936a9bdf220b9ebb02d725fab132fa58e464c23d0ac42c2cee

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
memory/588-66-0x00000000026F0000-0x0000000002730000-memory.dmp

Filesize
256KB

Download
memory/588-61-0x00000000026F0000-0x0000000002730000-memory.dmp

Filesize
256KB

Download
memory/588-62-0x00000000026F0000-0x0000000002730000-memory.dmp

Filesize
256KB

Download
memory/588-63-0x00000000026F0000-0x0000000002730000-memory.dmp

Filesize
256KB

Download
memory/588-67-0x00000000026F0000-0x0000000002730000-memory.dmp

Filesize
256KB

Download
memory/588-65-0x00000000026F0000-0x0000000002730000-memory.dmp

Filesize
256KB

Download
memory/700-75-0x00000000027D0000-0x0000000002810000-memory.dmp

Filesize
256KB

Download
memory/700-76-0x00000000027D0000-0x0000000002810000-memory.dmp

Filesize
256KB

Download
memory/928-64-0x0000000005110000-0x0000000005150000-memory.dmp

Filesize
256KB

Download
memory/928-58-0x0000000005150000-0x00000000051E2000-memory.dmp

Filesize
584KB

Download
memory/928-57-0x00000000006B0000-0x00000000006C0000-memory.dmp

Filesize
64KB

Download
memory/928-54-0x0000000001000000-0x0000000001380000-memory.dmp

Filesize
3.5MB

Download
memory/928-55-0x0000000005110000-0x0000000005150000-memory.dmp

Filesize
256KB

Download
memory/928-56-0x0000000009090000-0x0000000009330000-memory.dmp

Filesize
2.6MB

Download
memory/1700-80-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/1700-79-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/1700-82-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/1700-81-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1700-84-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/1700-85-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/1700-86-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/1700-78-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/1700-77-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/1700-146-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download