stealc | 69230b88fdebae6ed7cfee6e835bb659e9f197cd1ea7f047e9d951e98c5f9e01

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 03:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e90cbff460414a9bd5b8ba2c9680bca2f85d3a38b4d2b2242f8c176d102f72f.exe
Size

202KB
MD5

b9c81870733125e8ce37bd69ca0dd5fa
SHA1

331ce4e42c1f05984d0dfe8def855513f2209711
SHA256

4e90cbff460414a9bd5b8ba2c9680bca2f85d3a38b4d2b2242f8c176d102f72f
SHA512

18678d2cfb07fdd05c50ac41d12d12c5e47cd44d18931ee5c3ba94510093ca155dbda0580df87d03a9885c9c6034a49bc90a9fde73c9a601f48d654db56c0632
SSDEEP

3072:+WKxaOMqLfy1wPgNY01xznuiOsL7dNUUs/VkVbs+5XOORED9:XK/LK2PgTdIsL7/UUkVqy

Score

10^/10

stealc discovery spyware stealer

Malware Config

Extracted

Family

stealc

http://185.172.128.79

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2432	4e90cbff460414a9bd5b8ba2c9680bca2f85d3a38b4d2b2242f8c176d102f72f.exe
2432	4e90cbff460414a9bd5b8ba2c9680bca2f85d3a38b4d2b2242f8c176d102f72f.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	4e90cbff460414a9bd5b8ba2c9680bca2f85d3a38b4d2b2242f8c176d102f72f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	4e90cbff460414a9bd5b8ba2c9680bca2f85d3a38b4d2b2242f8c176d102f72f.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2432	4e90cbff460414a9bd5b8ba2c9680bca2f85d3a38b4d2b2242f8c176d102f72f.exe

C:\Users\Admin\AppData\Local\Temp\4e90cbff460414a9bd5b8ba2c9680bca2f85d3a38b4d2b2242f8c176d102f72f.exe
"C:\Users\Admin\AppData\Local\Temp\4e90cbff460414a9bd5b8ba2c9680bca2f85d3a38b4d2b2242f8c176d102f72f.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\mozglue.dll

Filesize
180KB

MD5
69a2232c32d916528909e8538fcea595

SHA1
26689e4dd4ef40d056a2cbec119beea81c168b37

SHA256
2f7cda4597f1beab541f05e17d5cd6491ece30a6f93e2966b468b888f80f8e7f

SHA512
8b5302092ac813844a33f0b3adb2d9823f67d1b2bd9faf418a8b8534be80b1635c918e3c5eb6a6abc68ceed9b7b9b2ad2e823564b2c04121edef17e093ca6085

Download Submit
\ProgramData\nss3.dll

Filesize
249KB

MD5
c7785e17be6207a2a53b06dbebe62748

SHA1
2b90a6d72ed29bec528d6731cba77cf2619cd2d1

SHA256
583d3b6b694275e716432350bb06ade03b89b9d379de926eb653f96f504017d1

SHA512
6bb149d272e56324e21dcc28d13e04ace27c578556f6e6e517d65d08331cef9c30b21ceaf81bf0d6fde5979cfd42eb5d899fe87cb749a2ec82ddabc7359ec9f6

Download Submit
memory/2432-35-0x0000000000950000-0x0000000000A50000-memory.dmp

Filesize
1024KB

Download
memory/2432-4-0x0000000000400000-0x0000000000854000-memory.dmp

Filesize
4.3MB

Download
memory/2432-5-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2432-27-0x0000000000400000-0x0000000000854000-memory.dmp

Filesize
4.3MB

Download
memory/2432-1-0x0000000000950000-0x0000000000A50000-memory.dmp

Filesize
1024KB

Download
memory/2432-36-0x0000000000220000-0x000000000023C000-memory.dmp

Filesize
112KB

Download
memory/2432-37-0x0000000000400000-0x0000000000854000-memory.dmp

Filesize
4.3MB

Download
memory/2432-42-0x0000000000400000-0x0000000000854000-memory.dmp

Filesize
4.3MB

Download
memory/2432-47-0x0000000000400000-0x0000000000854000-memory.dmp

Filesize
4.3MB

Download
memory/2432-51-0x0000000000400000-0x0000000000854000-memory.dmp

Filesize
4.3MB

Download
memory/2432-3-0x0000000000400000-0x0000000000854000-memory.dmp

Filesize
4.3MB

Download
memory/2432-2-0x0000000000220000-0x000000000023C000-memory.dmp

Filesize
112KB

Download
memory/2432-76-0x0000000000400000-0x0000000000854000-memory.dmp

Filesize
4.3MB

Download