stealc | 7cad2736657900f406a1baad62257b4a6ae83094d8adf5479365d3c1f86a52ee

General

Target

s5.exe
Size

300KB
MD5

9a62739541ca9161faf8271d39da1abd
SHA1

21a9df23a61d6f1bd87654fa0f604a020aad3370
SHA256

7cad2736657900f406a1baad62257b4a6ae83094d8adf5479365d3c1f86a52ee
SHA512

ecec29755623d404145b14913e014a9b682cd2e61b3cb0aa44c86499cc4636a6f5dc58c6ae7d97dde755c09a04c2d66cf90603894faefdd4c27a6518fe935f2d
SSDEEP

3072:yXQ0jpnLCHyqMBS9DlBt1R2rA594PILwzhY1SJg+zIAAFIa1wz/XUA5/3O:yRLiypahBt1kymmcgw1MwTXUC3

Score

10^/10

stealc spyware stealer

Malware Config

Extracted

Family

stealc

C2

http://5.78.40.0/60ed11b9deeca694.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Deletes itself 1 IoCs

pid	Process
2752	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2660	8722589475.exe

Loads dropped DLL 4 IoCs

pid	Process
2080	cmd.exe
2080	cmd.exe
2660	8722589475.exe
2660	8722589475.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2880	taskkill.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2660	8722589475.exe
2660	8722589475.exe
2660	8722589475.exe
2660	8722589475.exe
2660	8722589475.exe
2660	8722589475.exe
2660	8722589475.exe
2660	8722589475.exe
2660	8722589475.exe
2660	8722589475.exe
2660	8722589475.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2880	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2080	1680	s5.exe	29
PID 1680 wrote to memory of 2080	1680	s5.exe	29
PID 1680 wrote to memory of 2080	1680	s5.exe	29
PID 1680 wrote to memory of 2080	1680	s5.exe	29
PID 2080 wrote to memory of 2660	2080	cmd.exe	31
PID 2080 wrote to memory of 2660	2080	cmd.exe	31
PID 2080 wrote to memory of 2660	2080	cmd.exe	31
PID 2080 wrote to memory of 2660	2080	cmd.exe	31
PID 1680 wrote to memory of 2752	1680	s5.exe	33
PID 1680 wrote to memory of 2752	1680	s5.exe	33
PID 1680 wrote to memory of 2752	1680	s5.exe	33
PID 1680 wrote to memory of 2752	1680	s5.exe	33
PID 2752 wrote to memory of 2880	2752	cmd.exe	35
PID 2752 wrote to memory of 2880	2752	cmd.exe	35
PID 2752 wrote to memory of 2880	2752	cmd.exe	35
PID 2752 wrote to memory of 2880	2752	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\s5.exe
"C:\Users\Admin\AppData\Local\Temp\s5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\8722589475.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Local\Temp\8722589475.exe
    "C:\Users\Admin\AppData\Local\Temp\8722589475.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2660
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "s5.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\s5.exe" & exit
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "s5.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\DisableCopy.txt

Filesize
1.2MB

MD5
36c534645193ed1b6419e4564bfd3ba6

SHA1
770c129ce0a38cc4af81b676da546bb41149c327

SHA256
77b2bc667dfac336138085e32881fc3bd32bbe32035ad1b727080ecec609afd0

SHA512
3925860cd5929895881328f6e8357b8318410f3a6a8696b06a64a4661d2cc90c471aa61ef5fd4e4ff7de11351f43125f7a8144484fbc5ab7c363a327e67724c3

Download Submit
C:\ProgramData\MoveLimit.txt

Filesize
362KB

MD5
53426af6531b4edd2750502e43e8bc1b

SHA1
7da934d75f4b331eb977a8dbe1d8a22437baa6e9

SHA256
10a6d4e89a0deb0a2d391899d15045ac504ddd9f3ce8c742a318d8a69371c4d6

SHA512
62838084c32ef6e1ead1f138808749b0b9df1247e20d8378bd57d125e421d97b0b0b284a03b5d7abea86375757757995b157b8af9d06740cbfb5d64e05cf112a

Download Submit
C:\Users\Admin\AppData\Local\Temp\8722589475.exe

Filesize
250KB

MD5
d6dbf2a5e0622b6cfcffd97c83544de8

SHA1
0ef6f968938cb35a7442276b5b767c15c31d5cac

SHA256
718854f80aabe365455bc2a6f0584cae572dd81862615a2412f6d5d9b4333625

SHA512
cd95c6b938ca9bc49fb815d797e56dde4823a2f3fb9171a7b9759a97b3ad75e4124d7cae7ed30880689ee8f0ce598a06126134b689a9c572de3ea7706ca9deaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\8722589475.exe

Filesize
250KB

MD5
d6dbf2a5e0622b6cfcffd97c83544de8

SHA1
0ef6f968938cb35a7442276b5b767c15c31d5cac

SHA256
718854f80aabe365455bc2a6f0584cae572dd81862615a2412f6d5d9b4333625

SHA512
cd95c6b938ca9bc49fb815d797e56dde4823a2f3fb9171a7b9759a97b3ad75e4124d7cae7ed30880689ee8f0ce598a06126134b689a9c572de3ea7706ca9deaa

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
\Users\Admin\AppData\Local\Temp\8722589475.exe

Filesize
250KB

MD5
d6dbf2a5e0622b6cfcffd97c83544de8

SHA1
0ef6f968938cb35a7442276b5b767c15c31d5cac

SHA256
718854f80aabe365455bc2a6f0584cae572dd81862615a2412f6d5d9b4333625

SHA512
cd95c6b938ca9bc49fb815d797e56dde4823a2f3fb9171a7b9759a97b3ad75e4124d7cae7ed30880689ee8f0ce598a06126134b689a9c572de3ea7706ca9deaa

Download Submit
\Users\Admin\AppData\Local\Temp\8722589475.exe

Filesize
250KB

MD5
d6dbf2a5e0622b6cfcffd97c83544de8

SHA1
0ef6f968938cb35a7442276b5b767c15c31d5cac

SHA256
718854f80aabe365455bc2a6f0584cae572dd81862615a2412f6d5d9b4333625

SHA512
cd95c6b938ca9bc49fb815d797e56dde4823a2f3fb9171a7b9759a97b3ad75e4124d7cae7ed30880689ee8f0ce598a06126134b689a9c572de3ea7706ca9deaa

Download Submit
memory/1680-53-0x00000000002C0000-0x00000000002E4000-memory.dmp

Filesize
144KB

Download
memory/1680-54-0x00000000002F0000-0x000000000032E000-memory.dmp

Filesize
248KB

Download
memory/1680-70-0x0000000000400000-0x00000000018C8000-memory.dmp

Filesize
20.8MB

Download
memory/1680-72-0x00000000002F0000-0x000000000032E000-memory.dmp

Filesize
248KB

Download
memory/1680-73-0x00000000002C0000-0x00000000002E4000-memory.dmp

Filesize
144KB

Download
memory/1680-55-0x0000000000400000-0x00000000018C8000-memory.dmp

Filesize
20.8MB

Download
memory/2660-67-0x0000000002730000-0x0000000002830000-memory.dmp

Filesize
1024KB

Download
memory/2660-68-0x00000000003D0000-0x00000000003EB000-memory.dmp

Filesize
108KB

Download
memory/2660-129-0x0000000000400000-0x00000000022E6000-memory.dmp

Filesize
30.9MB

Download
memory/2660-133-0x0000000002730000-0x0000000002830000-memory.dmp

Filesize
1024KB

Download
memory/2660-134-0x0000000000400000-0x00000000022E6000-memory.dmp

Filesize
30.9MB

Download
memory/2660-74-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2660-69-0x0000000000400000-0x00000000022E6000-memory.dmp

Filesize
30.9MB

Download
memory/2660-168-0x0000000000400000-0x00000000022E6000-memory.dmp

Filesize
30.9MB

Download
memory/2660-169-0x0000000002730000-0x0000000002830000-memory.dmp

Filesize
1024KB

Download

Resubmissions

Analysis

Sharing