Analysis
-
max time kernel
142s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
27/11/2023, 20:30
General
-
Target
2a2bb8d33801ed6f07b7382d6a630d6f8592b74e0de0723182231efe8ad07240.exe
-
Size
282KB
-
MD5
a09d318fe0d18de5e447cec6e3345924
-
SHA1
184299be9effcc866aaea82503fc5bda5af1f031
-
SHA256
2a2bb8d33801ed6f07b7382d6a630d6f8592b74e0de0723182231efe8ad07240
-
SHA512
e977792b733dff681a9c4e084c38b7ca888b0def74f803f0a9230e1d5827677fc6f93cf3ad87d7635957b45bbadc1ae83f0402b51dfdbd637f49ab701ec920af
-
SSDEEP
6144:JohGYyVKogK+JvnVuR63MUzZXDhWrLGGYzS2Lc:JoHQb+JPs63RzJhWrqHzS2L
Score
10/10
Malware Config
Extracted
Family
stealc
C2
http://janmorath.icu
Attributes
-
url_path
/40d570f44e84a454.php
rc4.plain
Signatures
-
Stealc
Stealc is an infostealer written in C++.
-
Downloads MZ/PE file
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a2bb8d33801ed6f07b7382d6a630d6f8592b74e0de0723182231efe8ad07240.exe"C:\Users\Admin\AppData\Local\Temp\2a2bb8d33801ed6f07b7382d6a630d6f8592b74e0de0723182231efe8ad07240.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
108KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
108KB
-
Filesize
1024KB