fce4891d0ca542d32448ba0d79fe853654cbd7eeb81768ac36cb0316609ea8a0

Analysis

max time kernel
1482s
max time network
1461s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
26-12-2023 23:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Creal-Stealer-main/Creal.py
Size

42KB
MD5

fea991e39b09a902a852c6937ea2c4da
SHA1

9ac29c2b31dabed65e7a716587840e2a1815cd42
SHA256

baa6a5816056c73f157f72d0cc3875832033eeeb261049374567a85a83d0253a
SHA512

6344376db55cc871f27b380862f2648f90d9ef4f0c37e83ddd64ed011c68c67c55cee50d9536414e7bf88d7a7bb645fb5648c08339dfddeee98d82af98fd4bc5
SSDEEP

768:Q1DAWRknXeihOCSlqLCxzAj6VppDPi7WR:Q1kWRknhhFSQLhmVpoWR

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-771046930-2949676035-3337286276-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-771046930-2949676035-3337286276-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-771046930-2949676035-3337286276-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1672	OpenWith.exe
4212	MiniSearchHost.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Creal-Stealer-main\Creal.py
1⤵
- Modifies registry class
PID:1924

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1672

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4692

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
94a3800cd07b487c8ea7b23fc358ea29

SHA1
4fb9a6ef780d93728e3adc9c17377f2ee7b2f70b

SHA256
c4cb6a098a5b4108493ab8a117b7cc7f7aac4b8a4df48e32c6909c8a5f96a351

SHA512
ecc32f9527fd245c893ac1256c3ec86c2256f1f1f7d92705348e108a6997ed1588bbf18d0e2d5c2b02e87f8d849ed2856149b823c66be0cad43cdd6719715250

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
306153da52035a4826c245760b8133b0

SHA1
ec5a122f65df784b7b24e8bdf8256f8d18b86e08

SHA256
911d0cbb972286012dc971dc187ee233daa745ac40b401bfafb3566ca3344282

SHA512
53bf4308bc7f17268fb6b2282c1c3b638367b8d3cebec1cdb7574a54d35f993d6f31b7f0ad8b568eea08ef0b0be882eb306e66809f0135c30f2868cc6a995785

Download Submit