stealc | 3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2023 13:34

Target

97ec989085e99d2df0426b73620812b0.exe
Size

1.5MB
MD5

97ec989085e99d2df0426b73620812b0
SHA1

3e0f2934165679dd59094e75915a222d5788f381
SHA256

3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8
SHA512

8ef9f76d00b8cefa56806420d2602b667c700b253c6f61f954935865d1c921fffb002911ce3c4da57d9038e9fc87bcd5e0ef46ea6f2454114b8cd92939cd30a5
SSDEEP

12288:wL1Gr7+TspeaV64tA0sMdrl3xWzWF+ZuIXW3GAuk2RxRSzG:Vr7+TspeaV64yIlB472CZRxa

Score

10^/10

stealc stealer

Family

stealc

http://94.131.107.238/3aa13fff14e398a1.php

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4348 set thread context of 4112	4348	97ec989085e99d2df0426b73620812b0.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3716	4112	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4112	InstallUtil.exe
4112	InstallUtil.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 4112	4348	97ec989085e99d2df0426b73620812b0.exe	83
PID 4348 wrote to memory of 4112	4348	97ec989085e99d2df0426b73620812b0.exe	83
PID 4348 wrote to memory of 4112	4348	97ec989085e99d2df0426b73620812b0.exe	83
PID 4348 wrote to memory of 4112	4348	97ec989085e99d2df0426b73620812b0.exe	83
PID 4348 wrote to memory of 4112	4348	97ec989085e99d2df0426b73620812b0.exe	83
PID 4348 wrote to memory of 4112	4348	97ec989085e99d2df0426b73620812b0.exe	83
PID 4348 wrote to memory of 4112	4348	97ec989085e99d2df0426b73620812b0.exe	83
PID 4348 wrote to memory of 4112	4348	97ec989085e99d2df0426b73620812b0.exe	83
PID 4348 wrote to memory of 4112	4348	97ec989085e99d2df0426b73620812b0.exe	83

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4112 -ip 4112
1⤵
PID:4696

memory/4112-134-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/4112-137-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/4112-138-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/4112-139-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/4112-140-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/4348-133-0x0000000000320000-0x00000000004FA000-memory.dmp

Filesize
1.9MB

Download
memory/4348-136-0x0000000000320000-0x00000000004FA000-memory.dmp

Filesize
1.9MB

Download