stealc | 8d6460c1b6956e715d116aa2f086452d4e4cbabc98b40e8998460a078161f15f

Analysis

max time kernel
146s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0780e009018b7873acee0a21355848fe.exe
Size 346KB
Sample240220-eb7pdsae2w
SHA256 8d6460c1b6956e715d116aa2f086452d4e4cbabc98b40e8998460a078161f15f
MD5 0780e009018b7873acee0a21355848fe
SHA1 3a899273af94fd127c24e284eab1815a70de45a9
SHA512 fd4cf56150ecb30ff075aa99a5683b18aef6d04aa7a27ac5098533020a7a807b6b89ebd010079c0fe8b0072932a5239ed3e180586068323db6a2671467feb5eb
SSDEEP 6144:ZaEeh0xTczoVZDHVQGRQfusfU4H7qhWfAimfjp:9PnVFHzC77beLd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc discovery spyware stealer

Malware Config

Extracted

Family

stealc

http://185.172.128.79

Attributes

url_path
/3cd2b41cbde8fc9c.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2072	u1m4.0.exe
2472	u1m4.1.exe

Loads dropped DLL 10 IoCs

pid	Process
2092	0780e009018b7873acee0a21355848fe.exe
2092	0780e009018b7873acee0a21355848fe.exe
2092	0780e009018b7873acee0a21355848fe.exe
2092	0780e009018b7873acee0a21355848fe.exe
2092	0780e009018b7873acee0a21355848fe.exe
2092	0780e009018b7873acee0a21355848fe.exe
2092	0780e009018b7873acee0a21355848fe.exe
2092	0780e009018b7873acee0a21355848fe.exe
2072	u1m4.0.exe
2072	u1m4.0.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	u1m4.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	u1m4.0.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2072	u1m4.0.exe
2072	u1m4.0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2472	u1m4.1.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2072	2092	0780e009018b7873acee0a21355848fe.exe	28
PID 2092 wrote to memory of 2072	2092	0780e009018b7873acee0a21355848fe.exe	28
PID 2092 wrote to memory of 2072	2092	0780e009018b7873acee0a21355848fe.exe	28
PID 2092 wrote to memory of 2072	2092	0780e009018b7873acee0a21355848fe.exe	28
PID 2092 wrote to memory of 2472	2092	0780e009018b7873acee0a21355848fe.exe	29
PID 2092 wrote to memory of 2472	2092	0780e009018b7873acee0a21355848fe.exe	29
PID 2092 wrote to memory of 2472	2092	0780e009018b7873acee0a21355848fe.exe	29
PID 2092 wrote to memory of 2472	2092	0780e009018b7873acee0a21355848fe.exe	29
PID 2472 wrote to memory of 1780	2472	u1m4.1.exe	31
PID 2472 wrote to memory of 1780	2472	u1m4.1.exe	31
PID 2472 wrote to memory of 1780	2472	u1m4.1.exe	31
PID 2472 wrote to memory of 1780	2472	u1m4.1.exe	31
PID 1780 wrote to memory of 1868	1780	cmd.exe	33
PID 1780 wrote to memory of 1868	1780	cmd.exe	33
PID 1780 wrote to memory of 1868	1780	cmd.exe	33
PID 1780 wrote to memory of 1868	1780	cmd.exe	33
PID 1780 wrote to memory of 1664	1780	cmd.exe	34
PID 1780 wrote to memory of 1664	1780	cmd.exe	34
PID 1780 wrote to memory of 1664	1780	cmd.exe	34
PID 1780 wrote to memory of 1664	1780	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\0780e009018b7873acee0a21355848fe.exe
"C:\Users\Admin\AppData\Local\Temp\0780e009018b7873acee0a21355848fe.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Users\Admin\AppData\Local\Temp\u1m4.0.exe
  "C:\Users\Admin\AppData\Local\Temp\u1m4.0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2072
- C:\Users\Admin\AppData\Local\Temp\u1m4.1.exe
  "C:\Users\Admin\AppData\Local\Temp\u1m4.1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:1868
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
      4⤵
      Creates scheduled task(s)
      PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

u1m4.1.exe

Path C:\Users\Admin\AppData\Local\Temp\u1m4.1.exe
Size 1.6MB
SHA256 d9c7a67187eb8cb5c16aceb54e55e658f6e12cdf352fd0b45597709847f713f4
MD5 6538076c11cedc510e21164ab3604415
SHA1 82641bee04503bf1e02e73f6e3be4cbc800da7f9
SHA512 c40a8fee1463d723f230bf5c04a99d98413295677b030d315a2f63421d0dec7c11989162c522dcea321b47bdebe2f2d2f9f19058811522a6285237798b5ef6fd
SSDEEP 24576:9T8Eb3E5kMG9S1UDWmAdd81rpEti0Bhboss/IBhAbGHNhRXOqVH5V:90oSiZ63B
MD5 SHA1 SHA512 SSDEEP

Submit Download

u1m4.1.exe

Path C:\Users\Admin\AppData\Local\Temp\u1m4.1.exe
Size 1.4MB
SHA256 5b2fd649a681550d84ef8f00182a3b1c3d4965e5dcbe5f51b92a05838cbc8988
MD5 c648f45623e99730b67fbed044c83cbf
SHA1 09b4079bb84ad04816d3464c2ed679422d23872d
SHA512 24d39a63f95ee7eb160791e3a7ed0b553a3a4c4a747554016937cb65ebe7f3b729c50de4fbb5fb64f25303472ca3ce9be4e6062143f20d9c09314ccb29876157
SSDEEP 24576:9T8Eb3E5kMG9S1UDWmAdd81rpEti0Bhboss/IBhAbGHT:90oSiZ+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Task.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Task.bat
Size 128B
SHA256 6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
MD5 11bb3db51f701d4e42d3287f71a6a43e
SHA1 63a4ee82223be6a62d04bdfe40ef8ba91ae49a86
SHA512 907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2
MD5 SHA1 SHA512

Submit Download

mozglue.dll

Path \ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path \ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

u1m4.0.exe

Path \Users\Admin\AppData\Local\Temp\u1m4.0.exe
Size 228KB
SHA256 6eca8b24dd0d2804116757151bcc85f3ef3eebb0e4d4da4f974192e78cd0c773
MD5 e43227e4cad3830b355f94b5c612c619
SHA1 8b7e1bcd5f3d6c53eb813437ae54b81a4352aab9
SHA512 ffe143d93624fb4745035cf4acff088847c42f22e091cbdd6a5be4295e685fe0f87d518780bf8de2ceaad484b345df55125f1fa56b486a9c109fc8d16ec7030c
SSDEEP 3072:Lz21S3rE91+MmJfI6N6i3qT1P0JGfwOcWX4d1sK99UJMT9iK0M5IJeu:hK+MmRNgi6TBwG47Zr7ZxmE
MD5 SHA1 SHA512 SSDEEP

Submit Download

u1m4.1.exe

Path \Users\Admin\AppData\Local\Temp\u1m4.1.exe
Size 1.6MB
SHA256 fa539bb549de66ccbff361c01d2efe8b93774d3b4d1a7f1474e202788482a246
MD5 1103b488b300e29f1f8c8c3f5e1c4cba
SHA1 301edcea7d75db05d8345fc089be939f2acbcefb
SHA512 686929560a0d571ed3280deecf94999267abdc0f17026047372fcb3abf4596bdead793cee2d642daa741d3ede1f9e2d9d1c5f31b62cf311b6eb32572aace0673
SSDEEP 24576:9T8Eb3E5kMG9S1UDWmAdd81rpEti0Bhboss/IBhAbGHNhRXOqVH5Q:90oSiZ63U
MD5 SHA1 SHA512 SSDEEP

Submit Download

u1m4.1.exe

Path \Users\Admin\AppData\Local\Temp\u1m4.1.exe
Size 1.5MB
SHA256 c406b8f9de0d04c1bf9fc610f5f016c2c86d615ac28e68ae7dacb65dc3557560
MD5 8953702eed11c66f7a03b782b450c056
SHA1 390588331ba52ba8be502eb5d282c59e6a589010
SHA512 fab8f6ff70ca1cac11b1c09eed02315a059c587e9d012215c66c49df494ab8067e1f35a2da1db80497c960bb3f2713a880fc86a96fd4858cd6863af0fca9f911
SSDEEP 24576:9T8Eb3E5kMG9S1UDWmAdd81rpEti0Bhboss/IBhAbGHNh9:90oSiZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

u1m4.1.exe

Path \Users\Admin\AppData\Local\Temp\u1m4.1.exe
Size 1.7MB
SHA256 78a3e7e3366e8a59b8d9d6089bf7a572e6c0ba92346ee484411675baae95bfb8
MD5 4781df417bd518272b8a185651807749
SHA1 9fe91fadcf8abcb4291b1f5153457786fff63d92
SHA512 60eff563a9fdb8f738bf11717041e0095a38878fd1c4747011e131f900ff0b2aa62c8cf7e5b09d0ee791abdc6cb05b93f6470e9e4348a4a8d3d91c7d24f1695c
SSDEEP 24576:9T8Eb3E5kMG9S1UDWmAdd81rpEti0Bhboss/IBhAbGHNhRXOqVH5aHBBoS9z:90oSiZ63YBmS9z
MD5 SHA1 SHA512 SSDEEP

Submit Download

u1m4.1.exe

Path \Users\Admin\AppData\Local\Temp\u1m4.1.exe
Size 1.4MB
SHA256 47e3a1e037d64ca174afaf06bb9b9a4f72ad1ae7ad2f0bef0b03ac0b1ef8dc81
MD5 f29533170580e88dab99354578677dda
SHA1 514d337ab11f154ee9502fff592edafd3f9b4064
SHA512 ebd6c1b1a7ec679ce16bdb7141a90bd4f7c2e245b1d35af8b7338b9bddd054d49cce5543ea6882543dfb55c6e252ca570ccf86a155e52fc8341767e42ed2313f
SSDEEP 24576:9T8Eb3E5kMG9S1UDWmAdd81rpEti0Bhboss/IBhAbGHK:90oSiZL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2072-20-0x00000000002F0000-0x00000000003F0000-memory.dmp

Download

memory/2072-21-0x00000000001B0000-0x00000000001E4000-memory.dmp

Download

memory/2072-115-0x00000000002F0000-0x00000000003F0000-memory.dmp

Download

memory/2072-22-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/2072-114-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/2072-111-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/2072-40-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/2092-37-0x0000000000400000-0x0000000000469000-memory.dmp

Download

memory/2092-3-0x0000000000400000-0x0000000000469000-memory.dmp

Download

memory/2092-2-0x00000000006E0000-0x0000000000747000-memory.dmp

Download

memory/2092-38-0x00000000006E0000-0x0000000000747000-memory.dmp

Download

memory/2092-1-0x00000000008D0000-0x00000000009D0000-memory.dmp

Download

memory/2472-112-0x0000000000400000-0x00000000008E2000-memory.dmp

Download

memory/2472-39-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2472-117-0x0000000000230000-0x0000000000231000-memory.dmp

Download