stealc | 1afe857d1b5f2c0ff48ebbd2f32abf11f9b310416b1273e77adc7ee37f001ff8

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 18:26

Target

Samples 1/2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8.exe
Size

253KB
MD5

09e6dc2b8078d3dd8f661b718bfa1b51
SHA1

0179a6d09224b0f764140218af8005d3d253966b
SHA256

2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8
SHA512

884540c36743c7488c3e117e41319e9abe48a0af708c27336550dea6a387d4d3f16970417f9b5b49d3ec11bb1872e0e7d0d2ea4a4f42af25a27995297ba6f15d
SSDEEP

3072:cFRNd9JnGLn/tFCmpnnbTLQ8lHVvJ+5vxjyOgPBWQeNUtlkq5X+blVEf:mRNd9tGLnlFJpnbTLQ8JWp+OQFtt+DI

Score

10^/10

stealc stealer

Family

stealc

http://robertjohnson.top

Attributes

rc4.plain

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4212 3492 WerFault.exe 2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8.exe

pid	pid_target	process	target process
4212	3492	WerFault.exe	2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8.exe

C:\Users\Admin\AppData\Local\Temp\Samples 1\2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8.exe
"C:\Users\Admin\AppData\Local\Temp\Samples 1\2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8.exe"
1⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 384
2⤵
- Program crash
PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3492 -ip 3492
1⤵
PID:1396

memory/3492-1-0x0000000000710000-0x0000000000810000-memory.dmp

Filesize
1024KB

Download
memory/3492-2-0x0000000002380000-0x000000000239B000-memory.dmp

Filesize
108KB

Download
memory/3492-3-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/3492-4-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download