stealc | e30d0c23bba711c7fa9e7e192cc6682cf86806d34cf4a24a1ba0985336e4ec23

General

Target

Pre_Activated_Full_Working_Setup.exe
Size

4.3MB
MD5

a5692bff8a7b2c906526cf2f18c9edbd
SHA1

0e564275fb1c1305c014137bb61ddeaac92e50e8
SHA256

1b00f3e1af34bfb0e10636b8d3172ec8669f61c8cf392fe4d0c902a75ff01e65
SHA512

87e159c25ed83b6d83132b7bb28a375dcce890c5078fc2c845c19aaf28dc79a4238df3ec587e7e740d3e4b11c2f68b70f7073d9ffbf462340e83e814057949a6
SSDEEP

49152:Kgh98D4xlsAOPmUIkUI8RUyvhoDCfGC0fLqaNl1XvGTx/S5rcWXeXNPJG12bCp:ra71fUY2+p

Score

10^/10

stealc 7263693538461616705525145712 spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

7263693538461616705525145712

C2

http://185.244.48.191

Attributes

url_path
/c7f0d33720d0f381.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file
Loads dropped DLL 2 IoCs

Processes:

explorer.exe

pid process

3084 explorer.exe
3084 explorer.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

Pre_Activated_Full_Working_Setup.exe

description pid process target process

PID 2316 set thread context of 4172 2316 Pre_Activated_Full_Working_Setup.exe cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3084	explorer.exe
3084	explorer.exe

description	pid	process	target process
PID 2316 set thread context of 4172	2316	Pre_Activated_Full_Working_Setup.exe	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Pre_Activated_Full_Working_Setup.execmd.exeexplorer.exe

pid process

2316 Pre_Activated_Full_Working_Setup.exe
2316 Pre_Activated_Full_Working_Setup.exe
4172 cmd.exe
3084 explorer.exe
3084 explorer.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

Pre_Activated_Full_Working_Setup.execmd.exe

pid process

2316 Pre_Activated_Full_Working_Setup.exe
4172 cmd.exe

pid	process
2316	Pre_Activated_Full_Working_Setup.exe
2316	Pre_Activated_Full_Working_Setup.exe
4172	cmd.exe
3084	explorer.exe
3084	explorer.exe

pid	process
2316	Pre_Activated_Full_Working_Setup.exe
4172	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Pre_Activated_Full_Working_Setup.execmd.exe

description	pid	process	target process
PID 2316 wrote to memory of 4172	2316	Pre_Activated_Full_Working_Setup.exe	cmd.exe
PID 2316 wrote to memory of 4172	2316	Pre_Activated_Full_Working_Setup.exe	cmd.exe
PID 2316 wrote to memory of 4172	2316	Pre_Activated_Full_Working_Setup.exe	cmd.exe
PID 2316 wrote to memory of 4172	2316	Pre_Activated_Full_Working_Setup.exe	cmd.exe
PID 4172 wrote to memory of 3084	4172	cmd.exe	explorer.exe
PID 4172 wrote to memory of 3084	4172	cmd.exe	explorer.exe
PID 4172 wrote to memory of 3084	4172	cmd.exe	explorer.exe
PID 4172 wrote to memory of 3084	4172	cmd.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\Pre_Activated_Full_Working_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Pre_Activated_Full_Working_Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2316

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4172

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3084

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll
Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll
Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Temp\1e6b2b97
Filesize
528KB

MD5
a789701151210706e7faac74f33ea802

SHA1
e15e918015e506ec2d2d526f44eecdd39007793d

SHA256
10d5bb96f6bb261dbc344b9ce40f95b1643c888406d94aaa4ebd7ce2f6a98782

SHA512
bc086f65fa6c21f2c8098df4cdadaf3528fbe45c130940a5bb07ed2b914f2de7ac00b6ebbc390f8018684027a5500d09154b44c5c151e587d5a3dc544bc9b73d

Download Submit
memory/2316-0-0x00007FF8A2200000-0x00007FF8A3877000-memory.dmp

Filesize
22.5MB

Download
memory/2316-1-0x0000000000400000-0x0000000000856000-memory.dmp

Filesize
4.3MB

Download
memory/3084-18-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/3084-11-0x0000000000E00000-0x000000000102E000-memory.dmp

Filesize
2.2MB

Download
memory/3084-13-0x00007FF8C1AF0000-0x00007FF8C1CE5000-memory.dmp

Filesize
2.0MB

Download
memory/3084-14-0x0000000000E00000-0x000000000102E000-memory.dmp

Filesize
2.2MB

Download
memory/3084-16-0x0000000000690000-0x0000000000AC3000-memory.dmp

Filesize
4.2MB

Download
memory/3084-17-0x0000000000E00000-0x000000000102E000-memory.dmp

Filesize
2.2MB

Download
memory/3084-83-0x0000000000E00000-0x000000000102E000-memory.dmp

Filesize
2.2MB

Download
memory/4172-10-0x0000000074990000-0x0000000075BE4000-memory.dmp

Filesize
18.3MB

Download
memory/4172-8-0x0000000074990000-0x0000000075BE4000-memory.dmp

Filesize
18.3MB

Download
memory/4172-7-0x0000000074990000-0x0000000075BE4000-memory.dmp

Filesize
18.3MB

Download
memory/4172-5-0x00007FF8C1AF0000-0x00007FF8C1CE5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing