stealc | 3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
15-08-2023 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exe
Size

1.5MB
MD5

97ec989085e99d2df0426b73620812b0
SHA1

3e0f2934165679dd59094e75915a222d5788f381
SHA256

3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8
SHA512

8ef9f76d00b8cefa56806420d2602b667c700b253c6f61f954935865d1c921fffb002911ce3c4da57d9038e9fc87bcd5e0ef46ea6f2454114b8cd92939cd30a5
SSDEEP

12288:wL1Gr7+TspeaV64tA0sMdrl3xWzWF+ZuIXW3GAuk2RxRSzG:Vr7+TspeaV64yIlB472CZRxa

Score

10^/10

stealc stealer

Malware Config

Extracted

Family

stealc

http://94.131.107.238/3aa13fff14e398a1.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Suspicious use of SetThreadContext 1 IoCs

Processes:

3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exe

description	pid	Process	procid_target
PID 1400 set thread context of 1968	1400	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exe	29

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1640	1968	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

InstallUtil.exe

pid	Process
1968	InstallUtil.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exeInstallUtil.exe

description	pid	Process	procid_target
PID 1400 wrote to memory of 1968	1400	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exe	29
PID 1400 wrote to memory of 1968	1400	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exe	29
PID 1400 wrote to memory of 1968	1400	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exe	29
PID 1400 wrote to memory of 1968	1400	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exe	29
PID 1400 wrote to memory of 1968	1400	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exe	29
PID 1400 wrote to memory of 1968	1400	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exe	29
PID 1400 wrote to memory of 1968	1400	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exe	29
PID 1400 wrote to memory of 1968	1400	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exe	29
PID 1400 wrote to memory of 1968	1400	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exe	29
PID 1400 wrote to memory of 1968	1400	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exe	29
PID 1400 wrote to memory of 1968	1400	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exe	29
PID 1400 wrote to memory of 1968	1400	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exe	29
PID 1400 wrote to memory of 1968	1400	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exe	29
PID 1968 wrote to memory of 1640	1968	InstallUtil.exe	31
PID 1968 wrote to memory of 1640	1968	InstallUtil.exe	31
PID 1968 wrote to memory of 1640	1968	InstallUtil.exe	31
PID 1968 wrote to memory of 1640	1968	InstallUtil.exe	31

C:\Users\Admin\AppData\Local\Temp\3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exe
"C:\Users\Admin\AppData\Local\Temp\3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 716
    3⤵
    - Program crash
    PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1400-53-0x0000000000C00000-0x0000000000DDA000-memory.dmp

Filesize
1.9MB

Download
memory/1400-55-0x0000000000C00000-0x0000000000DDA000-memory.dmp

Filesize
1.9MB

Download
memory/1968-54-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/1968-57-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/1968-58-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/1968-59-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download