fce4891d0ca542d32448ba0d79fe853654cbd7eeb81768ac36cb0316609ea8a0

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
10/12/2023, 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Creal-Stealer-main/img/Creal1.png
Size

125KB
MD5

6271e9479ab97b47ef0a8543929d0a41
SHA1

8dd6f15f81ed0795b6515d9eaad001b01c260236
SHA256

6dd2df78e55f5aac25774126be7ea7c4b6702a4fce9d754a44907ed9e302970b
SHA512

8af3ff6c18fc6b2eda80f16822d55057046988ed53ac75e2d64c5c101554fe29c8fc8e4c2c0363af4bd1621b362e8fa4fdcc4cee9e45f1d36798e7df095590b0
SSDEEP

3072:LBppyv9bTX34UjQGHzhoRSQnBrOYF8z+34lVry:LBppyvhXoUjpHzSSNYF8S34lty

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Creal-Stealer-main\img\Creal1.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2976-0-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2976-1-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download