Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    24/10/2023, 06:07

General

  • Target

    file.exe

  • Size

    176KB

  • MD5

    9df35ee08d982c22a8e8bbac157f04e1

  • SHA1

    d4ea6693ad91b8f5bd60189d52d734c223deac01

  • SHA256

    04a6c4289f601c803614782d3399e7f8ad80f7e784b65ebae34fcc65d65bcac0

  • SHA512

    49232549287baf9884b8201bc9d048c6fd2209c0f75cd23e16766e719692c055c8a926e412a494ce185fc9849947c2f10ab61a594ae75e18ea5d27c3e32eb692

  • SSDEEP

    3072:/uBNaqxS6x6XUZEKmh3cB6xQE64iVn5susz+Fm0PrmY:6Eqo6x6XUZEKi3ckQX4s6/zLs

Malware Config

Extracted

Family

stealc

C2

http://wy�ttsebastian.top

Attributes
  • url_path

    /e9c345fc99a4e67e.php

rc4.plain

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

  • Downloads MZ/PE file
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:2820

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2820-1-0x0000000000270000-0x0000000000370000-memory.dmp

    Filesize

    1024KB

  • memory/2820-2-0x00000000003E0000-0x00000000003FB000-memory.dmp

    Filesize

    108KB

  • memory/2820-3-0x0000000000400000-0x00000000007B4000-memory.dmp

    Filesize

    3.7MB

  • memory/2820-4-0x0000000000270000-0x0000000000370000-memory.dmp

    Filesize

    1024KB

  • memory/2820-5-0x0000000000400000-0x00000000007B4000-memory.dmp

    Filesize

    3.7MB

  • memory/2820-6-0x00000000003E0000-0x00000000003FB000-memory.dmp

    Filesize

    108KB

  • memory/2820-7-0x0000000000400000-0x00000000007B4000-memory.dmp

    Filesize

    3.7MB

  • memory/2820-11-0x0000000000400000-0x00000000007B4000-memory.dmp

    Filesize

    3.7MB

  • memory/2820-12-0x0000000000270000-0x0000000000370000-memory.dmp

    Filesize

    1024KB