Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
05/11/2023, 17:51
General
-
Target
09e6dc2b8078d3dd8f661b718bfa1b51.exe
-
Size
253KB
-
MD5
09e6dc2b8078d3dd8f661b718bfa1b51
-
SHA1
0179a6d09224b0f764140218af8005d3d253966b
-
SHA256
2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8
-
SHA512
884540c36743c7488c3e117e41319e9abe48a0af708c27336550dea6a387d4d3f16970417f9b5b49d3ec11bb1872e0e7d0d2ea4a4f42af25a27995297ba6f15d
-
SSDEEP
3072:cFRNd9JnGLn/tFCmpnnbTLQ8lHVvJ+5vxjyOgPBWQeNUtlkq5X+blVEf:mRNd9tGLnlFJpnbTLQ8JWp+OQFtt+DI
Malware Config
Extracted
stealc
http://robertjohnson.top
-
url_path
/e9c345fc99a4e67e.php
Signatures
-
Stealc
Stealc is an infostealer written in C++.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09e6dc2b8078d3dd8f661b718bfa1b51.exe"C:\Users\Admin\AppData\Local\Temp\09e6dc2b8078d3dd8f661b718bfa1b51.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
108KB
-
Filesize
2.2MB
-
Filesize
2.2MB