stealc | 47a6fd99a56ef8c056bdb5d480cd387e56b3bdb11ad6ed4b7cb5ae80148b0118

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

237KB
MD5

9103dcf0a79de0249ad4c6ba7b263452
SHA1

41112c67a893f7ad732f0fac333df24c5299f750
SHA256

47a6fd99a56ef8c056bdb5d480cd387e56b3bdb11ad6ed4b7cb5ae80148b0118
SHA512

a1120158d58a985e252b5dd2aede7274dea146e56e3ce69a9a418922860d3da1de1e907cff21e29390b07c28199ee60774bfb66ff929a3931473f3f669159538
SSDEEP

3072:ERSQpGanOMAuJi4k1KjHPXpPhdbzjvOkrefIVacKjER/d+T:ER1RA4hNjVexQdI

Score

10^/10

stealc discovery spyware stealer

Malware Config

Extracted

Family

stealc

http://185.172.128.79

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Deletes itself 1 IoCs

pid	Process
268	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
2088	tmp.exe
2088	tmp.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	tmp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	tmp.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2960	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2088	tmp.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 268	2088	tmp.exe	29
PID 2088 wrote to memory of 268	2088	tmp.exe	29
PID 2088 wrote to memory of 268	2088	tmp.exe	29
PID 2088 wrote to memory of 268	2088	tmp.exe	29
PID 268 wrote to memory of 2960	268	cmd.exe	31
PID 268 wrote to memory of 2960	268	cmd.exe	31
PID 268 wrote to memory of 2960	268	cmd.exe	31
PID 268 wrote to memory of 2960	268	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\tmp.exe" & del "C:\ProgramData\*.dll"" & exit
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\mozglue.dll

Filesize
256KB

MD5
d56637ea2ca40bc8b22303c9f274cd91

SHA1
c729b37a70880edae19c9cbfc37d6abc54d8dae9

SHA256
0d3f8ec284e987e994a99f7929aa65842cf17d2f88deff7358fa5cd90ff51de1

SHA512
c6ce71956e40f75b70f2bd74a063d4ba3cb7384d50fc01d06c6a1e969d53b0044257262c683f931ee5e43e5f9062e9ffdd1aca46eb1f8be75cb2c39d843bcbe3

Download Submit
\ProgramData\nss3.dll

Filesize
1.4MB

MD5
900a9cb2cc6cda7b0f3f1a0523e8d00f

SHA1
bdc9864471dd5652d662108b0feb435d527f0f7a

SHA256
81dca456eb526b57a43cf6c75bcac3e9fe3807ec59462a5e18db883585a7fd5c

SHA512
d1bb25e415a08ffac7f6815b53588995cb3e3709abb49a90a71996c00263d57b3ff7908a961c9e75acf49b8e4303faa2d67157281975bdcfc09b978c3d4524c5

Download Submit
memory/2088-2-0x0000000000220000-0x000000000023C000-memory.dmp

Filesize
112KB

Download
memory/2088-1-0x00000000006E0000-0x00000000007E0000-memory.dmp

Filesize
1024KB

Download
memory/2088-3-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/2088-4-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2088-60-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/2088-73-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/2088-74-0x00000000006E0000-0x00000000007E0000-memory.dmp

Filesize
1024KB

Download