c63eeb3e872b93ebce0ff49a3524133dc099017763c73dfe3779ee031f525053

Analysis

max time kernel
154s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2023, 13:38

Target

cstealer-main/README.md
Size

5KB
MD5

4c3d65af4c3a541b8260bdbcfb2e4246
SHA1

6b6df676fd2add7d0fa0ce4b04ef07c275bad687
SHA256

62e47e1c0a289846bdc1f907c4fd74963d2ec655d3002eeb71f58a26d8568bea
SHA512

8f4188b7ece197663f7bd148e03b94746bb1b202e7555fa2ccf3b65a0f172be024c5ee83f56a7efbdd19bbf10efc04c117260bf4b03d11b54ca06ee4ad2d671d
SSDEEP

96:UIL6rU6RImEUttIGI21IHVAH7ndJFK5RSQgbWI4WIbWIBQWI4JE+BWm7GwUhgZ:UXrUED17wVAH7vMMna9jQAxqM

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3168	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cstealer-main\README.md
1⤵
- Modifies registry class
PID:768

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact