c63eeb3e872b93ebce0ff49a3524133dc099017763c73dfe3779ee031f525053

Analysis

max time kernel
56s
max time network
30s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
27/06/2023, 13:38

Target

cstealer-main/img/ss3.png
Size

73KB
MD5

b66069e5439fff208ac980d6a459c0ff
SHA1

c43e9b3ae6907370172af99115c3e98e2a4e9dbd
SHA256

26a2bd36cfe5ecc4b9e5cbe6ca15fca382c4c688791d98c8533cce85ccf9f228
SHA512

9e3b534f65d42f7b220054ea6aefdfe5a9a514c209d0b4f41bd0a6683c6c8421c485f1c37d73848517510550ecf034cdc408eb4362a6fe3aca093b18ccc81fab
SSDEEP

1536:KeUynvxz/vzTMhTfNHZsKsSyC2f+h9KHaTLkQs9Jg1vdOdtKvdTelf:KES1hZXWk+HaPkQCJg1vkdtKSf

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1304	rundll32.exe
1304	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\cstealer-main\img\ss3.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1304

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1304-54-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1304-55-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download