stealc | f8be822eb877bfb50b6d04449004f9778ed732b877c4f2975313b8559cf6e842

General

Target

53640549adeafc14bff28e22e.exe
Size

750KB
MD5

53640549adeafc14bff28e22e378b681
SHA1

c46173128148a0fb90c7aa67553068035edc8d04
SHA256

f8be822eb877bfb50b6d04449004f9778ed732b877c4f2975313b8559cf6e842
SHA512

0c74669ac5fcc63f0579acd7a377bf286e5bb3b5e574efbc14e541471c87b46d88bc6e76e2bd974223a079944acda0a7a7f7ca829f2e2e8de0a88acc9653ff24
SSDEEP

12288:VS/nqdGGwe4kVt7eKS9HvO1WVZ08yDgG:cSwGwNZKMeX

Score

10^/10

stealc evasion stealer

Malware Config

Extracted

Family

stealc

C2

http://45.150.65.128/bcbdd35a8286b150.php

Signatures

Detects Stealc stealer 5 IoCs

stealer

resource	yara_rule
behavioral1/memory/2956-63-0x0000000000400000-0x0000000000629000-memory.dmp	family_stealc
behavioral1/memory/2956-65-0x0000000000400000-0x0000000000629000-memory.dmp	family_stealc
behavioral1/memory/2956-67-0x0000000000400000-0x0000000000629000-memory.dmp	family_stealc
behavioral1/memory/2956-68-0x0000000000400000-0x0000000000629000-memory.dmp	family_stealc
behavioral1/memory/2956-69-0x0000000000400000-0x0000000000629000-memory.dmp	family_stealc

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	53640549adeafc14bff28e22e.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	53640549adeafc14bff28e22e.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	53640549adeafc14bff28e22e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	53640549adeafc14bff28e22e.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	53640549adeafc14bff28e22e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	53640549adeafc14bff28e22e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1384 set thread context of 2956	1384	53640549adeafc14bff28e22e.exe	29

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2956	1384	53640549adeafc14bff28e22e.exe	29
PID 1384 wrote to memory of 2956	1384	53640549adeafc14bff28e22e.exe	29
PID 1384 wrote to memory of 2956	1384	53640549adeafc14bff28e22e.exe	29
PID 1384 wrote to memory of 2956	1384	53640549adeafc14bff28e22e.exe	29
PID 1384 wrote to memory of 2956	1384	53640549adeafc14bff28e22e.exe	29
PID 1384 wrote to memory of 2956	1384	53640549adeafc14bff28e22e.exe	29
PID 1384 wrote to memory of 2956	1384	53640549adeafc14bff28e22e.exe	29
PID 1384 wrote to memory of 2956	1384	53640549adeafc14bff28e22e.exe	29
PID 1384 wrote to memory of 2956	1384	53640549adeafc14bff28e22e.exe	29

C:\Users\Admin\AppData\Local\Temp\53640549adeafc14bff28e22e.exe
"C:\Users\Admin\AppData\Local\Temp\53640549adeafc14bff28e22e.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\AppData\Local\Temp\53640549adeafc14bff28e22e.exe
  "{path}"
  2⤵
  PID:2956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1384-54-0x0000000000260000-0x0000000000320000-memory.dmp

Filesize
768KB

Download
memory/1384-55-0x0000000004DD0000-0x0000000004E10000-memory.dmp

Filesize
256KB

Download
memory/1384-56-0x0000000004DD0000-0x0000000004E10000-memory.dmp

Filesize
256KB

Download
memory/1384-57-0x0000000000320000-0x0000000000334000-memory.dmp

Filesize
80KB

Download
memory/1384-58-0x0000000005760000-0x00000000057D8000-memory.dmp

Filesize
480KB

Download
memory/1384-59-0x0000000004390000-0x00000000043BA000-memory.dmp

Filesize
168KB

Download
memory/2956-60-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/2956-61-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/2956-62-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/2956-63-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/2956-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2956-65-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/2956-67-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/2956-68-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/2956-69-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads