stealc | 88b485b2505fa50a505d0cddb6f7ea10a60d137e008a0e29a04e18efc63a1cd7

General

Target

file.exe
Size

265KB
MD5

62682dd05ce9c8d39825c021ed80bbbd
SHA1

a4d81f0d71f6e26ac4673db25aa312407221c707
SHA256

88b485b2505fa50a505d0cddb6f7ea10a60d137e008a0e29a04e18efc63a1cd7
SHA512

e92839f4881c47af34b34380ca878c92332575e9f1ca84fb54cf3d68d588323f430f2916d03243fe846e2539212118f3f14bea7c7cafafeda3dc5d1251494601
SSDEEP

3072:/DuFuMxDFtkZAUo4iOYxRW5kYXLgQ/ws1/wNb8Tobsyxd:KuMxjkZA/4TYmtXEQpwlIy

Score

10^/10

stealc discovery spyware stealer

Malware Config

Extracted

Family

stealc

C2

http://henryjackson.icu

Attributes

url_path
/e9c345fc99a4e67e.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4000	5000	WerFault.exe	85

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5000	file.exe
5000	file.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4080	svchost.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 1372
  2⤵
  - Program crash
  PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5000 -ip 5000
1⤵
PID:1504

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
efc03251b3033d6a278c2e306ec051c4

SHA1
f691f748c43eba54f75670b4f96c4937775943bd

SHA256
5078115f0fadc93461cc4d0a0695f9e9f644f9859031f9c191b9eccdfc466920

SHA512
05717e7573fb28b355bd4755d00df8439984618dddd1fb16ff8486c9f1ed911d8a6d9e091f9dc191f529673cf8ad8f4e54e5a548a821e51a4ec3f0d5926e6e09

Download Submit
memory/4080-46-0x000001AC45E60000-0x000001AC45E61000-memory.dmp

Filesize
4KB

Download
memory/4080-73-0x000001AC45BD0000-0x000001AC45BD1000-memory.dmp

Filesize
4KB

Download
memory/4080-75-0x000001AC45CE0000-0x000001AC45CE1000-memory.dmp

Filesize
4KB

Download
memory/4080-74-0x000001AC45BD0000-0x000001AC45BD1000-memory.dmp

Filesize
4KB

Download
memory/4080-7-0x000001AC3D750000-0x000001AC3D760000-memory.dmp

Filesize
64KB

Download
memory/4080-23-0x000001AC3D850000-0x000001AC3D860000-memory.dmp

Filesize
64KB

Download
memory/4080-39-0x000001AC45E40000-0x000001AC45E41000-memory.dmp

Filesize
4KB

Download
memory/4080-40-0x000001AC45E60000-0x000001AC45E61000-memory.dmp

Filesize
4KB

Download
memory/4080-41-0x000001AC45E60000-0x000001AC45E61000-memory.dmp

Filesize
4KB

Download
memory/4080-42-0x000001AC45E60000-0x000001AC45E61000-memory.dmp

Filesize
4KB

Download
memory/4080-43-0x000001AC45E60000-0x000001AC45E61000-memory.dmp

Filesize
4KB

Download
memory/4080-47-0x000001AC45E60000-0x000001AC45E61000-memory.dmp

Filesize
4KB

Download
memory/4080-71-0x000001AC45BC0000-0x000001AC45BC1000-memory.dmp

Filesize
4KB

Download
memory/4080-45-0x000001AC45E60000-0x000001AC45E61000-memory.dmp

Filesize
4KB

Download
memory/4080-44-0x000001AC45E60000-0x000001AC45E61000-memory.dmp

Filesize
4KB

Download
memory/4080-48-0x000001AC45E60000-0x000001AC45E61000-memory.dmp

Filesize
4KB

Download
memory/4080-49-0x000001AC45E60000-0x000001AC45E61000-memory.dmp

Filesize
4KB

Download
memory/4080-50-0x000001AC45A90000-0x000001AC45A91000-memory.dmp

Filesize
4KB

Download
memory/4080-51-0x000001AC45A80000-0x000001AC45A81000-memory.dmp

Filesize
4KB

Download
memory/4080-53-0x000001AC45A90000-0x000001AC45A91000-memory.dmp

Filesize
4KB

Download
memory/4080-56-0x000001AC45A80000-0x000001AC45A81000-memory.dmp

Filesize
4KB

Download
memory/4080-59-0x000001AC459C0000-0x000001AC459C1000-memory.dmp

Filesize
4KB

Download
memory/5000-2-0x0000000000970000-0x000000000098B000-memory.dmp

Filesize
108KB

Download
memory/5000-3-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/5000-1-0x00000000009A0000-0x0000000000AA0000-memory.dmp

Filesize
1024KB

Download
memory/5000-6-0x0000000000970000-0x000000000098B000-memory.dmp

Filesize
108KB

Download
memory/5000-5-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing