fce4891d0ca542d32448ba0d79fe853654cbd7eeb81768ac36cb0316609ea8a0

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/12/2023, 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Creal-Stealer-main/img/xd.jpg
Size

44KB
MD5

d8b7adbe864a5dfa9d0f9b9a54df1fa5
SHA1

3d583090faf9e28f127d30333cd2eba7ae076de9
SHA256

40cd9f31c18eb65248038220d8c6983de03702ec2f7bb5e38ccb248ff02b926d
SHA512

610f8f8946d417c6d7b64d05be56055277b54f3ed29b472d0f2cc9f08d6c1c42f8af40420ac328f0cee9fc5dccbc43e9b6ba6540c4f4530661e0bb613852375e
SSDEEP

768:1Vhv+czdSevhsTZHMpeiXYmui9JKEtZfB+ITJtD5VznC:1Vhv+cE6aTRriXYmbTKMpJP5VzC

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Creal-Stealer-main\img\xd.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3000-0-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/3000-1-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download