fce4891d0ca542d32448ba0d79fe853654cbd7eeb81768ac36cb0316609ea8a0

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/12/2023, 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Creal-Stealer-main/Creal.py
Size

42KB
MD5

fea991e39b09a902a852c6937ea2c4da
SHA1

9ac29c2b31dabed65e7a716587840e2a1815cd42
SHA256

baa6a5816056c73f157f72d0cc3875832033eeeb261049374567a85a83d0253a
SHA512

6344376db55cc871f27b380862f2648f90d9ef4f0c37e83ddd64ed011c68c67c55cee50d9536414e7bf88d7a7bb645fb5648c08339dfddeee98d82af98fd4bc5
SSDEEP

768:Q1DAWRknXeihOCSlqLCxzAj6VppDPi7WR:Q1kWRknhhFSQLhmVpoWR

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2648	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2648	AcroRd32.exe
2648	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2304	2344	cmd.exe	29
PID 2344 wrote to memory of 2304	2344	cmd.exe	29
PID 2344 wrote to memory of 2304	2344	cmd.exe	29
PID 2304 wrote to memory of 2648	2304	rundll32.exe	30
PID 2304 wrote to memory of 2648	2304	rundll32.exe	30
PID 2304 wrote to memory of 2648	2304	rundll32.exe	30
PID 2304 wrote to memory of 2648	2304	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Creal-Stealer-main\Creal.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Creal-Stealer-main\Creal.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Creal-Stealer-main\Creal.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3ab2a806d49f22d4fb2561d4ead5b885

SHA1
3a4189f83361c199616e6ec7ebbf2a53ed2b02df

SHA256
cb3e691c608abc4b2069c8e45224e2203e58d055e403f850bf463f89227c1fe9

SHA512
044da1260bdb354b5055053cc066096cedcfc1592b8225db6efbf0af79ff534c518ca13f16351ee20f8294df745333b18f2db3c01c341a681c13504b816d413b

Download Submit