330443e86efd23fd22c62a1fb09b86e1caa94e017bab089a92fb41e28ae9ceac

Analysis

max time kernel
87s
max time network
90s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
19-02-2024 20:42

Target

Creal-Stealer-main/requirements.txt
Size

70B
MD5

3ca8c2f8bd46429f6c70920b23c339c1
SHA1

a72901291d18702ab5645235ac674d9761b762d7
SHA256

848e72b70c88b58ddc834f65dfc423fe305ea154c7bb9fbe3c2062171de477bd
SHA512

1bc4163e85ed71addcbb9bfc9a554df3b2fe0d04f1d9ea06a6403614dfa24a1dd5c49985d706c85305db1c4cb552be5f3fa68724ee545de2bd14d3d2d6bbbaa5

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3404610768-3912631216-307532709-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 4204	2908	cmd.exe	80
PID 2908 wrote to memory of 4204	2908	cmd.exe	80

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Creal-Stealer-main\requirements.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Creal-Stealer-main\requirements.txt
  2⤵
  PID:4204

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact