stealc | 12cd64a6d63eb4c7ae10c011a65ea69f9ce0022197d39cb454cc63fc7e147f78

General

Target

file.exe
Size

344KB
MD5

ca4982bccfd8ac278771661a745cc364
SHA1

e2b269e7b951e59e47f5d151ecc023a893b9c0b2
SHA256

12cd64a6d63eb4c7ae10c011a65ea69f9ce0022197d39cb454cc63fc7e147f78
SHA512

7d11cc6245c28efba27f7c5edfb2aa2e4ed64e97881bd3a0e264537aeb2825e675bf1d567348fbce839f3a07674d22281074721b9c38af5cd13a67241d9f9ca2
SSDEEP

3072:4+dBqIZBDFjqGJB6tSmhi00OzMltSxc4QSoz7Meu5xjp+oexinsoQPPgJfJAP/oX:tRZ1FjN6/ultP7rCxF+oHsowgJfiAi

Score

10^/10

stealc discovery stealer

Malware Config

Extracted

Family

stealc

C2

http://aidandylan.top

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Deletes itself 1 IoCs

pid	Process
2884	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2228	1357423072.exe

Loads dropped DLL 2 IoCs

pid	Process
3020	cmd.exe
3020	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1357423072.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1357423072.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
620	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2228	1357423072.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	620	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 3020	2184	file.exe	31
PID 2184 wrote to memory of 3020	2184	file.exe	31
PID 2184 wrote to memory of 3020	2184	file.exe	31
PID 2184 wrote to memory of 3020	2184	file.exe	31
PID 3020 wrote to memory of 2228	3020	cmd.exe	33
PID 3020 wrote to memory of 2228	3020	cmd.exe	33
PID 3020 wrote to memory of 2228	3020	cmd.exe	33
PID 3020 wrote to memory of 2228	3020	cmd.exe	33
PID 2184 wrote to memory of 2884	2184	file.exe	35
PID 2184 wrote to memory of 2884	2184	file.exe	35
PID 2184 wrote to memory of 2884	2184	file.exe	35
PID 2184 wrote to memory of 2884	2184	file.exe	35
PID 2884 wrote to memory of 620	2884	cmd.exe	36
PID 2884 wrote to memory of 620	2884	cmd.exe	36
PID 2884 wrote to memory of 620	2884	cmd.exe	36
PID 2884 wrote to memory of 620	2884	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1357423072.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Users\Admin\AppData\Local\Temp\1357423072.exe
    "C:\Users\Admin\AppData\Local\Temp\1357423072.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2228
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "file.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1357423072.exe

Filesize
273KB

MD5
5730849eb052bd4101316c2f5611a0e5

SHA1
c2c3281370939ecbf8be5e7860f8e9a917dc26c0

SHA256
e883fa7f59e03330f417e03108e69508124fb6d44a7a65f2170a1eb56f44009d

SHA512
3c67fadce973e74ac6b5af03accf655c863c2c5445cdcb06f954947847053c0116796a5786f6f2e0db42974950ced068cb26cd8d61f971e6d469b507c5ba12b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1357423072.exe

Filesize
273KB

MD5
5730849eb052bd4101316c2f5611a0e5

SHA1
c2c3281370939ecbf8be5e7860f8e9a917dc26c0

SHA256
e883fa7f59e03330f417e03108e69508124fb6d44a7a65f2170a1eb56f44009d

SHA512
3c67fadce973e74ac6b5af03accf655c863c2c5445cdcb06f954947847053c0116796a5786f6f2e0db42974950ced068cb26cd8d61f971e6d469b507c5ba12b9

Download Submit
\Users\Admin\AppData\Local\Temp\1357423072.exe

Filesize
273KB

MD5
5730849eb052bd4101316c2f5611a0e5

SHA1
c2c3281370939ecbf8be5e7860f8e9a917dc26c0

SHA256
e883fa7f59e03330f417e03108e69508124fb6d44a7a65f2170a1eb56f44009d

SHA512
3c67fadce973e74ac6b5af03accf655c863c2c5445cdcb06f954947847053c0116796a5786f6f2e0db42974950ced068cb26cd8d61f971e6d469b507c5ba12b9

Download Submit
\Users\Admin\AppData\Local\Temp\1357423072.exe

Filesize
273KB

MD5
5730849eb052bd4101316c2f5611a0e5

SHA1
c2c3281370939ecbf8be5e7860f8e9a917dc26c0

SHA256
e883fa7f59e03330f417e03108e69508124fb6d44a7a65f2170a1eb56f44009d

SHA512
3c67fadce973e74ac6b5af03accf655c863c2c5445cdcb06f954947847053c0116796a5786f6f2e0db42974950ced068cb26cd8d61f971e6d469b507c5ba12b9

Download Submit
memory/2184-6-0x0000000000400000-0x0000000002293000-memory.dmp

Filesize
30.6MB

Download
memory/2184-33-0x0000000000290000-0x0000000000390000-memory.dmp

Filesize
1024KB

Download
memory/2184-1-0x0000000000290000-0x0000000000390000-memory.dmp

Filesize
1024KB

Download
memory/2184-5-0x0000000000290000-0x0000000000390000-memory.dmp

Filesize
1024KB

Download
memory/2184-3-0x0000000000400000-0x0000000002293000-memory.dmp

Filesize
30.6MB

Download
memory/2184-2-0x00000000039F0000-0x0000000003A2E000-memory.dmp

Filesize
248KB

Download
memory/2184-7-0x00000000039F0000-0x0000000003A2E000-memory.dmp

Filesize
248KB

Download
memory/2184-32-0x0000000000400000-0x0000000002293000-memory.dmp

Filesize
30.6MB

Download
memory/2228-31-0x0000000000400000-0x0000000002281000-memory.dmp

Filesize
30.5MB

Download
memory/2228-29-0x00000000023E0000-0x00000000024E0000-memory.dmp

Filesize
1024KB

Download
memory/2228-30-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/2228-34-0x0000000000400000-0x0000000002281000-memory.dmp

Filesize
30.5MB

Download
memory/2228-35-0x00000000023E0000-0x00000000024E0000-memory.dmp

Filesize
1024KB

Download
memory/2228-36-0x0000000000400000-0x0000000002281000-memory.dmp

Filesize
30.5MB

Download

Analysis

Sharing