stealc | 7cad2736657900f406a1baad62257b4a6ae83094d8adf5479365d3c1f86a52ee

General

Target

s5.exe
Size

300KB
MD5

9a62739541ca9161faf8271d39da1abd
SHA1

21a9df23a61d6f1bd87654fa0f604a020aad3370
SHA256

7cad2736657900f406a1baad62257b4a6ae83094d8adf5479365d3c1f86a52ee
SHA512

ecec29755623d404145b14913e014a9b682cd2e61b3cb0aa44c86499cc4636a6f5dc58c6ae7d97dde755c09a04c2d66cf90603894faefdd4c27a6518fe935f2d
SSDEEP

3072:yXQ0jpnLCHyqMBS9DlBt1R2rA594PILwzhY1SJg+zIAAFIa1wz/XUA5/3O:yRLiypahBt1kymmcgw1MwTXUC3

Score

10^/10

stealc spyware stealer

Malware Config

Extracted

Family

stealc

C2

http://5.78.40.0/60ed11b9deeca694.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1344	1639776563.exe

Loads dropped DLL 2 IoCs

pid	Process
1344	1639776563.exe
1344	1639776563.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4448	3984	WerFault.exe	81
4188	1344	WerFault.exe	90

Kills process with taskkill 1 IoCs

evasion

pid	Process
684	taskkill.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe
1344	1639776563.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	684	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 2528	3984	s5.exe	88
PID 3984 wrote to memory of 2528	3984	s5.exe	88
PID 3984 wrote to memory of 2528	3984	s5.exe	88
PID 2528 wrote to memory of 1344	2528	cmd.exe	90
PID 2528 wrote to memory of 1344	2528	cmd.exe	90
PID 2528 wrote to memory of 1344	2528	cmd.exe	90
PID 3984 wrote to memory of 4984	3984	s5.exe	93
PID 3984 wrote to memory of 4984	3984	s5.exe	93
PID 3984 wrote to memory of 4984	3984	s5.exe	93
PID 4984 wrote to memory of 684	4984	cmd.exe	97
PID 4984 wrote to memory of 684	4984	cmd.exe	97
PID 4984 wrote to memory of 684	4984	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\s5.exe
"C:\Users\Admin\AppData\Local\Temp\s5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1639776563.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Users\Admin\AppData\Local\Temp\1639776563.exe
    "C:\Users\Admin\AppData\Local\Temp\1639776563.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1944
      4⤵
      Program crash
      PID:4188
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "s5.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\s5.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "s5.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 1476
  2⤵
  - Program crash
  PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3984 -ip 3984
1⤵
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1344 -ip 1344
1⤵
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\RemoveRequest.txt

Filesize
492KB

MD5
7705be961f39b3c31b3ee95678eda3f7

SHA1
508c9c5aeb1db65854380fbe8e614cd83db01612

SHA256
29767ebd593927d80b0ba7baa4123bf8f786747dfb672066f68021f6ff378609

SHA512
1dc6406771c51c059d7850de82ac4380e4a54266680c11c1bfd6451094d4dfd91f0e3a109b02b4ecebf689644cfc0cfc94ff965c252641c5f6feab041a11c019

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Temp\1639776563.exe

Filesize
250KB

MD5
d6dbf2a5e0622b6cfcffd97c83544de8

SHA1
0ef6f968938cb35a7442276b5b767c15c31d5cac

SHA256
718854f80aabe365455bc2a6f0584cae572dd81862615a2412f6d5d9b4333625

SHA512
cd95c6b938ca9bc49fb815d797e56dde4823a2f3fb9171a7b9759a97b3ad75e4124d7cae7ed30880689ee8f0ce598a06126134b689a9c572de3ea7706ca9deaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\1639776563.exe

Filesize
250KB

MD5
d6dbf2a5e0622b6cfcffd97c83544de8

SHA1
0ef6f968938cb35a7442276b5b767c15c31d5cac

SHA256
718854f80aabe365455bc2a6f0584cae572dd81862615a2412f6d5d9b4333625

SHA512
cd95c6b938ca9bc49fb815d797e56dde4823a2f3fb9171a7b9759a97b3ad75e4124d7cae7ed30880689ee8f0ce598a06126134b689a9c572de3ea7706ca9deaa

Download Submit
memory/1344-146-0x0000000002490000-0x0000000002590000-memory.dmp

Filesize
1024KB

Download
memory/1344-219-0x0000000000400000-0x00000000022E6000-memory.dmp

Filesize
30.9MB

Download
memory/1344-247-0x0000000000400000-0x00000000022E6000-memory.dmp

Filesize
30.9MB

Download
memory/1344-150-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/1344-225-0x0000000000400000-0x00000000022E6000-memory.dmp

Filesize
30.9MB

Download
memory/1344-224-0x0000000002490000-0x0000000002590000-memory.dmp

Filesize
1024KB

Download
memory/1344-148-0x0000000002450000-0x000000000246B000-memory.dmp

Filesize
108KB

Download
memory/1344-147-0x0000000000400000-0x00000000022E6000-memory.dmp

Filesize
30.9MB

Download
memory/3984-133-0x0000000003610000-0x0000000003634000-memory.dmp

Filesize
144KB

Download
memory/3984-135-0x0000000000400000-0x00000000018C8000-memory.dmp

Filesize
20.8MB

Download
memory/3984-190-0x0000000003640000-0x000000000367E000-memory.dmp

Filesize
248KB

Download
memory/3984-189-0x0000000000400000-0x00000000018C8000-memory.dmp

Filesize
20.8MB

Download
memory/3984-188-0x0000000003610000-0x0000000003634000-memory.dmp

Filesize
144KB

Download
memory/3984-134-0x0000000003640000-0x000000000367E000-memory.dmp

Filesize
248KB

Download
memory/3984-149-0x0000000000400000-0x00000000018C8000-memory.dmp

Filesize
20.8MB

Download

Resubmissions

Analysis

Sharing