stealc | 2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8

Analysis

max time kernel
159s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2023, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

09e6dc2b8078d3dd8f661b718bfa1b51.exe
Size

253KB
MD5

09e6dc2b8078d3dd8f661b718bfa1b51
SHA1

0179a6d09224b0f764140218af8005d3d253966b
SHA256

2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8
SHA512

884540c36743c7488c3e117e41319e9abe48a0af708c27336550dea6a387d4d3f16970417f9b5b49d3ec11bb1872e0e7d0d2ea4a4f42af25a27995297ba6f15d
SSDEEP

3072:cFRNd9JnGLn/tFCmpnnbTLQ8lHVvJ+5vxjyOgPBWQeNUtlkq5X+blVEf:mRNd9tGLnlFJpnbTLQ8JWp+OQFtt+DI

Score

10^/10

stealc discovery spyware stealer

Malware Config

Extracted

Family

stealc

http://robertjohnson.top

Attributes

url_path
/e9c345fc99a4e67e.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
812	1988	WerFault.exe	85

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	09e6dc2b8078d3dd8f661b718bfa1b51.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	09e6dc2b8078d3dd8f661b718bfa1b51.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1988	09e6dc2b8078d3dd8f661b718bfa1b51.exe
1988	09e6dc2b8078d3dd8f661b718bfa1b51.exe

C:\Users\Admin\AppData\Local\Temp\09e6dc2b8078d3dd8f661b718bfa1b51.exe
"C:\Users\Admin\AppData\Local\Temp\09e6dc2b8078d3dd8f661b718bfa1b51.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 1360
  2⤵
  - Program crash
  PID:812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1988 -ip 1988
1⤵
PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-1-0x00000000008C0000-0x00000000009C0000-memory.dmp

Filesize
1024KB

Download
memory/1988-2-0x0000000002370000-0x000000000238B000-memory.dmp

Filesize
108KB

Download
memory/1988-3-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/1988-5-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/1988-6-0x0000000002370000-0x000000000238B000-memory.dmp

Filesize
108KB

Download