stealc | 930c8a665255361326e0d97aef0f43844c08da20ddcb2949da46905ac5b86568

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16-08-2023 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe
Size

1.5MB
MD5

97ec989085e99d2df0426b73620812b0
SHA1

3e0f2934165679dd59094e75915a222d5788f381
SHA256

3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8
SHA512

8ef9f76d00b8cefa56806420d2602b667c700b253c6f61f954935865d1c921fffb002911ce3c4da57d9038e9fc87bcd5e0ef46ea6f2454114b8cd92939cd30a5
SSDEEP

12288:wL1Gr7+TspeaV64tA0sMdrl3xWzWF+ZuIXW3GAuk2RxRSzG:Vr7+TspeaV64yIlB472CZRxa

Score

10^/10

stealc stealer

Malware Config

Extracted

Family

stealc

http://94.131.107.238/3aa13fff14e398a1.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2224 set thread context of 2384	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	2384	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2384	InstallUtil.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1508	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	29
PID 2224 wrote to memory of 1508	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	29
PID 2224 wrote to memory of 1508	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	29
PID 2224 wrote to memory of 1508	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	29
PID 2224 wrote to memory of 1508	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	29
PID 2224 wrote to memory of 1508	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	29
PID 2224 wrote to memory of 1508	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	29
PID 2224 wrote to memory of 1508	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	29
PID 2224 wrote to memory of 2384	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	30
PID 2224 wrote to memory of 2384	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	30
PID 2224 wrote to memory of 2384	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	30
PID 2224 wrote to memory of 2384	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	30
PID 2224 wrote to memory of 2384	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	30
PID 2224 wrote to memory of 2384	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	30
PID 2224 wrote to memory of 2384	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	30
PID 2224 wrote to memory of 2384	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	30
PID 2224 wrote to memory of 2384	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	30
PID 2224 wrote to memory of 2384	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	30
PID 2224 wrote to memory of 2384	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	30
PID 2224 wrote to memory of 2384	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	30
PID 2224 wrote to memory of 2384	2224	3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe	30
PID 2384 wrote to memory of 2904	2384	InstallUtil.exe	32
PID 2384 wrote to memory of 2904	2384	InstallUtil.exe	32
PID 2384 wrote to memory of 2904	2384	InstallUtil.exe	32
PID 2384 wrote to memory of 2904	2384	InstallUtil.exe	32

C:\Users\Admin\AppData\Local\Temp\3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe
"C:\Users\Admin\AppData\Local\Temp\3d54f10e6726b1828ac0252c4bd80e0c4777bba4b34486c217bf2e629b8e67a8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:1508
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 708
    3⤵
    - Program crash
    PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-54-0x0000000000A00000-0x0000000000BDA000-memory.dmp

Filesize
1.9MB

Download
memory/2224-57-0x0000000000A00000-0x0000000000BDA000-memory.dmp

Filesize
1.9MB

Download
memory/2384-55-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2384-58-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2384-59-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2384-60-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download