stealc | d985a81e5db121bd7cd858d749aa6b8c2d997de99d80d43d6301a7a3fbaa633e | Triage

Analysis

max time kernel
88s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2023 22:21

Sharing

Report Analysis Logs

General

Target

1428-1113-0x0000000000400000-0x0000000000629000-memory.exe
Size

2.2MB
MD5

c6ff372a191cd3ceecbefe95144639a8
SHA1

cb8846daa39ef6fdf11a7969659c3f108aa1e8fe
SHA256

d985a81e5db121bd7cd858d749aa6b8c2d997de99d80d43d6301a7a3fbaa633e
SHA512

7d92c696839480079ba93ab66ead3d4ae7c604f5bfa46b9bab1c0e3145614aff0e373b8993a432a5a68a7f7a387ea6cfe044e555f242f19231dd2134fb11eda5
SSDEEP

12288:cFSwuD3/yZ/vfU56TfXDL97zjad7OM4bZTJ:c3J

Score

10^/10

stealc stealer

Malware Config

Signatures

Detects Stealc stealer 1 IoCs

resource	yara_rule
behavioral2/memory/3512-133-0x0000000000400000-0x0000000000629000-memory.dmp	family_stealc

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4596	3512	WerFault.exe	83

C:\Users\Admin\AppData\Local\Temp\1428-1113-0x0000000000400000-0x0000000000629000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1428-1113-0x0000000000400000-0x0000000000629000-memory.exe"
1⤵
PID:3512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 216
  2⤵
  - Program crash
  PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3512 -ip 3512
1⤵
PID:3740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3512-133-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download