stealc | d38178bcf1349b6cf6f0a136e56065093ed7f97ef10f8324b3967d1e957a274c

Analysis

max time kernel
100s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2023, 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

programsetup.exe
Size

3.5MB
MD5

53fb2627d1a83aa24541d5eef83a00b2
SHA1

08e5f2b40800f08c0427d45988fa617a4f1d7afe
SHA256

a38d41814b2eb62540eacd708033389c437f87f22d2561cbba21f542f43ed0d2
SHA512

c12749f62e4d742d7f18042a5a8b1a5eb8845a57da2dc0ed9e82320260747fd146420b6862632040a057f6ca7ac041b2812346d161c6ee550c2c9e26182b4a78
SSDEEP

49152:LyzsFHuAzxJgPUqariUo/ykNupCkqv7xPf0zyzF:

Score

10^/10

stealc persistence spyware stealer

Malware Config

Extracted

Family

stealc

http://5.42.64.88/cc18c73c655f48b7.php

Signatures

Detects Stealc stealer 1 IoCs

stealer

resource	yara_rule
behavioral20/memory/3808-273-0x0000000000400000-0x0000000000629000-memory.dmp	family_stealc

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	programsetup.exe

Loads dropped DLL 2 IoCs

pid	Process
3808	InstallUtil.exe
3808	InstallUtil.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wjdyae = "\"C:\\Users\\Admin\\AppData\\Roaming\\Wekmxvxynso\\Wjdyae.exe\""	programsetup.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4616 set thread context of 3808	4616	programsetup.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallUtil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallUtil.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1888	timeout.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1432	ipconfig.exe
4244	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1776	powershell.exe
1776	powershell.exe
3864	powershell.exe
3864	powershell.exe
3808	InstallUtil.exe
3808	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	programsetup.exe
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	3864	powershell.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4324	4616	programsetup.exe	82
PID 4616 wrote to memory of 4324	4616	programsetup.exe	82
PID 4616 wrote to memory of 4324	4616	programsetup.exe	82
PID 4324 wrote to memory of 1432	4324	cmd.exe	84
PID 4324 wrote to memory of 1432	4324	cmd.exe	84
PID 4324 wrote to memory of 1432	4324	cmd.exe	84
PID 4616 wrote to memory of 1776	4616	programsetup.exe	85
PID 4616 wrote to memory of 1776	4616	programsetup.exe	85
PID 4616 wrote to memory of 1776	4616	programsetup.exe	85
PID 4616 wrote to memory of 3648	4616	programsetup.exe	94
PID 4616 wrote to memory of 3648	4616	programsetup.exe	94
PID 4616 wrote to memory of 3648	4616	programsetup.exe	94
PID 3648 wrote to memory of 3864	3648	cmd.exe	96
PID 3648 wrote to memory of 3864	3648	cmd.exe	96
PID 3648 wrote to memory of 3864	3648	cmd.exe	96
PID 4616 wrote to memory of 1488	4616	programsetup.exe	97
PID 4616 wrote to memory of 1488	4616	programsetup.exe	97
PID 4616 wrote to memory of 1488	4616	programsetup.exe	97
PID 1488 wrote to memory of 4244	1488	cmd.exe	99
PID 1488 wrote to memory of 4244	1488	cmd.exe	99
PID 1488 wrote to memory of 4244	1488	cmd.exe	99
PID 4616 wrote to memory of 3808	4616	programsetup.exe	100
PID 4616 wrote to memory of 3808	4616	programsetup.exe	100
PID 4616 wrote to memory of 3808	4616	programsetup.exe	100
PID 4616 wrote to memory of 3808	4616	programsetup.exe	100
PID 4616 wrote to memory of 3808	4616	programsetup.exe	100
PID 4616 wrote to memory of 3808	4616	programsetup.exe	100
PID 4616 wrote to memory of 3808	4616	programsetup.exe	100
PID 4616 wrote to memory of 3808	4616	programsetup.exe	100
PID 3808 wrote to memory of 3336	3808	InstallUtil.exe	101
PID 3808 wrote to memory of 3336	3808	InstallUtil.exe	101
PID 3808 wrote to memory of 3336	3808	InstallUtil.exe	101
PID 3336 wrote to memory of 1888	3336	cmd.exe	103
PID 3336 wrote to memory of 1888	3336	cmd.exe	103
PID 3336 wrote to memory of 1888	3336	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\programsetup.exe
"C:\Users\Admin\AppData\Local\Temp\programsetup.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ipconfig /release
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:1432
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ipconfig /renew
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /renew
    3⤵
    - Gathers network information
    PID:4244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" & del "C:\ProgramData\*.dll"" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
4280e36a29fa31c01e4d8b2ba726a0d8

SHA1
c485c2c9ce0a99747b18d899b71dfa9a64dabe32

SHA256
e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

SHA512
494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
bb14257bf5fb8646017e187edb837c98

SHA1
3e32bbb5f12b5ebd31baa94d0a536665bf3bf62e

SHA256
7ac1401b691430b4f63cfa1a80e12ae315bbb8bbc03705891e5638b233e3c309

SHA512
434b9334d75acf7928bd2a5227bc2802f9335ddc82671940647738e03a3abc54318df39eccb602e1901cb525617b1ae01ed2da3e94da769e7c61e7e812dbaeee

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wrppkuo0.1wo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1776-161-0x00000000031A0000-0x00000000031B0000-memory.dmp

Filesize
64KB

Download
memory/1776-156-0x0000000007EE0000-0x000000000855A000-memory.dmp

Filesize
6.5MB

Download
memory/1776-141-0x00000000031A0000-0x00000000031B0000-memory.dmp

Filesize
64KB

Download
memory/1776-142-0x00000000031A0000-0x00000000031B0000-memory.dmp

Filesize
64KB

Download
memory/1776-143-0x0000000005FB0000-0x0000000006016000-memory.dmp

Filesize
408KB

Download
memory/1776-139-0x0000000005230000-0x0000000005266000-memory.dmp

Filesize
216KB

Download
memory/1776-146-0x0000000006150000-0x00000000061B6000-memory.dmp

Filesize
408KB

Download
memory/1776-154-0x00000000067A0000-0x00000000067BE000-memory.dmp

Filesize
120KB

Download
memory/1776-155-0x00000000031A0000-0x00000000031B0000-memory.dmp

Filesize
64KB

Download
memory/1776-140-0x00000000058A0000-0x0000000005EC8000-memory.dmp

Filesize
6.2MB

Download
memory/1776-157-0x0000000006C80000-0x0000000006C9A000-memory.dmp

Filesize
104KB

Download
memory/1776-160-0x00000000031A0000-0x00000000031B0000-memory.dmp

Filesize
64KB

Download
memory/1776-159-0x00000000031A0000-0x00000000031B0000-memory.dmp

Filesize
64KB

Download
memory/3808-273-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/3808-200-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/3808-197-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/3808-194-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/3808-181-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/3864-179-0x0000000004690000-0x00000000046A0000-memory.dmp

Filesize
64KB

Download
memory/3864-198-0x000000007F060000-0x000000007F070000-memory.dmp

Filesize
64KB

Download
memory/3864-180-0x0000000006C80000-0x0000000006CB2000-memory.dmp

Filesize
200KB

Download
memory/3864-249-0x0000000006FF0000-0x0000000006FF8000-memory.dmp

Filesize
32KB

Download
memory/3864-245-0x0000000007010000-0x000000000702A000-memory.dmp

Filesize
104KB

Download
memory/3864-195-0x0000000006C60000-0x0000000006C7E000-memory.dmp

Filesize
120KB

Download
memory/3864-184-0x0000000070240000-0x000000007028C000-memory.dmp

Filesize
304KB

Download
memory/3864-196-0x0000000006E60000-0x0000000006E6A000-memory.dmp

Filesize
40KB

Download
memory/3864-238-0x0000000005950000-0x000000000595E000-memory.dmp

Filesize
56KB

Download
memory/3864-178-0x0000000004690000-0x00000000046A0000-memory.dmp

Filesize
64KB

Download
memory/3864-199-0x0000000004690000-0x00000000046A0000-memory.dmp

Filesize
64KB

Download
memory/3864-203-0x00000000070B0000-0x0000000007146000-memory.dmp

Filesize
600KB

Download
memory/4616-133-0x00000000000E0000-0x0000000000460000-memory.dmp

Filesize
3.5MB

Download
memory/4616-138-0x00000000066A0000-0x00000000066C2000-memory.dmp

Filesize
136KB

Download
memory/4616-137-0x00000000050D0000-0x00000000050E0000-memory.dmp

Filesize
64KB

Download
memory/4616-136-0x0000000004DE0000-0x0000000004DEA000-memory.dmp

Filesize
40KB

Download
memory/4616-135-0x0000000004E70000-0x0000000004F02000-memory.dmp

Filesize
584KB

Download
memory/4616-134-0x0000000005420000-0x00000000059C4000-memory.dmp

Filesize
5.6MB

Download
memory/4616-158-0x00000000050D0000-0x00000000050E0000-memory.dmp

Filesize
64KB

Download