Analysis
-
max time kernel
118s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
23/02/2024, 02:03
General
-
Target
0993d4c07d308fe8dffae59c2bcea46471d87eb128e0212a295941bd7703733e.exe
-
Size
182KB
-
MD5
5239ca020f7751e9d634bd89366d2ed3
-
SHA1
d2d782542151f94574e91d0967f9ec5edfe3ed7d
-
SHA256
0993d4c07d308fe8dffae59c2bcea46471d87eb128e0212a295941bd7703733e
-
SHA512
819bf6cfcda3e490cd59d77bed2db82017b113dfa24dd69d45cab6801f7aba0ce2e51a341c4990648b23a4bbc571ad8dfd27f347dc899967ba8e3360c9745724
-
SSDEEP
3072:VH+kVcxpOIWfCQgwLpOx9uF79AklwKx4PlIGi:gf7OIaCodOWhhx4u
Malware Config
Extracted
stealc
http://185.172.128.145
-
url_path
/3cd2b41cbde8fc9c.php
Signatures
-
Stealc
Stealc is an infostealer written in C++.
-
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0993d4c07d308fe8dffae59c2bcea46471d87eb128e0212a295941bd7703733e.exe"C:\Users\Admin\AppData\Local\Temp\0993d4c07d308fe8dffae59c2bcea46471d87eb128e0212a295941bd7703733e.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
180KB
MD54aba16f46961a863ad09ea694dc45b55
SHA12a14b756296ce8767a85be19a9438643c6208150
SHA25672f06f049513ea6f53c52b704b1e64ba2a962f2cffcc4710685161702dca1385
SHA512b081c316c2dcaf12df2896d3c32f0f1e27ae96a920f2a01f3cd95aba7c5841144062ab3bdb137c3add3811505444ed0e934fef4c34a987c0e26b986402b6b6c7
-
Filesize
1024KB
-
Filesize
208KB
-
Filesize
4.1MB
-
Filesize
972KB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
208KB