Analysis
-
max time kernel
174s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
10/10/2023, 22:51
General
-
Target
file.exe
-
Size
245KB
-
MD5
025dd1c2cd5c3322c76e8cec0cefa8a7
-
SHA1
87368bacbd4d98fd9cb71ab5058def6cea438c56
-
SHA256
4af0042985b8bbc60007268c0ae6f929df7fc1415cc059e400acd6dde22f2e02
-
SHA512
fa5bbacb2d9f5b4e703b71452d21e6faba7d96850c2a6ea0e1008ee3703fecceb7de696ee605b4b6014d4c58dd568e6e0946134d835f69efe960ac1c9472ea95
-
SSDEEP
3072:g9XrjC5t+tqTKozQmpcmlWWNiBZYkz9sf9Zy20ybdM6QKbg52BTYTq:wa5mqHmmlWFBak2ZEaRpYTq
Malware Config
Extracted
stealc
http://jesseaustin.top
-
url_path
/e9c345fc99a4e67e.php
Signatures
-
Stealc
Stealc is an infostealer written in C++.
-
Downloads MZ/PE file
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
-
Filesize
108KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
84KB
-
Filesize
108KB
-
Filesize
2.2MB
-
Filesize
972KB
-
Filesize
2.2MB