Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
-
submitted
12-12-2023 05:55
General
-
Target
015da94a48702bde0297911a4872469d9f4851d5067acf3fbbd412cbe82377ef.exe
-
Size
190KB
-
MD5
c3cda4284fab6d48c2781c7e78dded15
-
SHA1
e0e6d1711ba8afcd402f232214a76bf3f9efa7ef
-
SHA256
015da94a48702bde0297911a4872469d9f4851d5067acf3fbbd412cbe82377ef
-
SHA512
9a188c5573f9fffcf3f487a40822f857ff0db995ecba5ad4b77ddc88b5964e89c58bc864d7960f77e218a6a159caaeda8d35bdda9712e9d3b2805ca04fb33a53
-
SSDEEP
3072:IJW9jLf7NyT1TAT2l3NUvtgDtvA2aGjxxkpzeJsV5kZ6q:l9jLzNyT1i43WODJA2TjxupIR
Score
10/10
Malware Config
Extracted
Family
stealc
C2
http://77.91.76.36
Attributes
-
url_path
/3886d2276f6914c4.php
rc4.plain
Signatures
-
Stealc
Stealc is an infostealer written in C++.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\015da94a48702bde0297911a4872469d9f4851d5067acf3fbbd412cbe82377ef.exe"C:\Users\Admin\AppData\Local\Temp\015da94a48702bde0297911a4872469d9f4851d5067acf3fbbd412cbe82377ef.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
112KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
1024KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB