Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Creal-Stea...in.zip
windows11-21h2-x64
1Creal-Stea...NG.yml
windows11-21h2-x64
3Creal-Stea...eal.py
windows11-21h2-x64
3Creal-Stea...ted.md
windows11-21h2-x64
3Creal-Stea...ICENSE
windows11-21h2-x64
1Creal-Stea...DME.md
windows11-21h2-x64
3Creal-Stea...er.bat
windows11-21h2-x64
1Creal-Stea...der.py
windows11-21h2-x64
3Creal-Stea...l1.png
windows11-21h2-x64
3Creal-Stea...l2.png
windows11-21h2-x64
3Creal-Stea...l3.png
windows11-21h2-x64
3Creal-Stea...rr.png
windows11-21h2-x64
Creal-Stea...yy.png
windows11-21h2-x64
3Creal-Stea...xd.jpg
windows11-21h2-x64
3Creal-Stea...ll.bat
windows11-21h2-x64
1Creal-Stea...on.bat
windows11-21h2-x64
8Creal-Stea...unk.py
windows11-21h2-x64
3Creal-Stea...ts.txt
windows11-21h2-x64
3Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20231128-en -
resource tags
arch:x64arch:x86image:win11-20231128-enlocale:en-usos:windows11-21h2-x64system -
submitted
11/12/2023, 23:48
Behavioral task
behavioral1
Sample
Creal-Stealer-main.zip
Resource
win11-20231128-en
Behavioral task
behavioral2
Sample
Creal-Stealer-main/.github/FUNDING.yml
Resource
win11-20231128-en
Behavioral task
behavioral3
Sample
Creal-Stealer-main/Creal.py
Resource
win11-20231129-en
Behavioral task
behavioral4
Sample
Creal-Stealer-main/IfYouInfected.md
Resource
win11-20231128-en
Behavioral task
behavioral5
Sample
Creal-Stealer-main/LICENSE
Resource
win11-20231128-en
Behavioral task
behavioral6
Sample
Creal-Stealer-main/README.md
Resource
win11-20231128-en
Behavioral task
behavioral7
Sample
Creal-Stealer-main/builder.bat
Resource
win11-20231128-en
Behavioral task
behavioral8
Sample
Creal-Stealer-main/builder.py
Resource
win11-20231128-en
Behavioral task
behavioral9
Sample
Creal-Stealer-main/img/Creal1.png
Resource
win11-20231128-en
Behavioral task
behavioral10
Sample
Creal-Stealer-main/img/Creal2.png
Resource
win11-20231129-en
Behavioral task
behavioral11
Sample
Creal-Stealer-main/img/Creal3.png
Resource
win11-20231129-en
Behavioral task
behavioral12
Sample
Creal-Stealer-main/img/builderr.png
Resource
win11-20231129-en
Behavioral task
behavioral13
Sample
Creal-Stealer-main/img/pyy.png
Resource
win11-20231129-en
Behavioral task
behavioral14
Sample
Creal-Stealer-main/img/xd.jpg
Resource
win11-20231129-en
Behavioral task
behavioral15
Sample
Creal-Stealer-main/install.bat
Resource
win11-20231128-en
Behavioral task
behavioral16
Sample
Creal-Stealer-main/install_python.bat
Resource
win11-20231128-en
Behavioral task
behavioral17
Sample
Creal-Stealer-main/junk.py
Resource
win11-20231128-en
Behavioral task
behavioral18
Sample
Creal-Stealer-main/requirements.txt
Resource
win11-20231128-en
General
-
Target
Creal-Stealer-main/builder.bat
-
Size
56B
-
MD5
001b0fde2e65ae4f8fa280ccdb746c93
-
SHA1
6f3ad8b217f090c0a37ae21ee6f0065e58635771
-
SHA256
06c326475f195707960159fd70e759bbba1f8b638fb4f749bad68fbb0b728aa2
-
SHA512
de065f3c04647f572bc8436c5aacd400956954bec23dcad8db2ddfe2689c37bb2ba0221e84ce11e826c9f9efc43d1782ccd28e76c9c25fba3e277f1b694c781a
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4488 wrote to memory of 1180 4488 cmd.exe 78 PID 4488 wrote to memory of 1180 4488 cmd.exe 78 PID 4488 wrote to memory of 1180 4488 cmd.exe 78
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Creal-Stealer-main\builder.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython builder.py2⤵PID:1180
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\AILog.txt
Filesize490B
MD55f767a82adbd66019d2208b761e950a6
SHA16e8a554d5648f3c75c442b5326b016294734b612
SHA2563e4be22b7e9586a84df408ff2eeda43e169506805aaaadaa96cb22e26899501c
SHA5121873e0bdf3a54add247e7e59c75f136d35e86be5587c0e8c6a31598c4289b80af150c8e13fbd2c3b660d828e08336453db2259918e2b4f7140a858d6a9cfabbd