crealstealer | 6e0f22d3c54d7680dd7d1a284f546d509a25d4a0e00d534733d23649c1904122

General

Target

6e0f22d3c54d7680dd7d1a284f546d509a25d4a0e00d534733d23649c1904122.exe
Size

13.1MB
MD5

ffad668e3893f27d0011b0acbc580477
SHA1

23ec45c30d56f48fd70ce794c4ffe8df53d0fc93
SHA256

6e0f22d3c54d7680dd7d1a284f546d509a25d4a0e00d534733d23649c1904122
SHA512

1930ca8726f0fa9435f84f484dc99d3925308d065a498270fa427241134bbf99d0bba3e58baea71a982a3c585014f4957acaa97a0aea343157cb14ca3a3080ab
SSDEEP

393216:SO+TZ1nFOl+bzkCu1tsTmtCyJnQYSvWXr/:SlZ1nS8Du126tCmb

Score

10^/10

Malware Config

Signatures

An infostealer written in Python and packaged with PyInstaller. 1 IoCs

resource	yara_rule
behavioral1/files/0x00040000000130fc-88.dat	crealstealer

crealstealer
An infostealer written in Python and packaged with PyInstaller.
stealer crealstealer

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/files/0x00040000000130fc-88.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
behavioral1/files/0x00040000000130fc-88.dat	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x00040000000130fc-88.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral1/files/0x00040000000130fc-88.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables packed with VMProtect. 3 IoCs

resource	yara_rule
behavioral1/memory/1988-4-0x000000013F800000-0x0000000141084000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/1988-36-0x000000013F800000-0x0000000141084000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/1988-140-0x000000013F800000-0x0000000141084000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

Executes dropped EXE 1 IoCs

pid	Process
2836	test.exe

Loads dropped DLL 2 IoCs

pid	Process
1988	6e0f22d3c54d7680dd7d1a284f546d509a25d4a0e00d534733d23649c1904122.exe
2836	test.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1988-4-0x000000013F800000-0x0000000141084000-memory.dmp	vmprotect
behavioral1/memory/1988-36-0x000000013F800000-0x0000000141084000-memory.dmp	vmprotect
behavioral1/memory/1988-140-0x000000013F800000-0x0000000141084000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1988	6e0f22d3c54d7680dd7d1a284f546d509a25d4a0e00d534733d23649c1904122.exe
1988	6e0f22d3c54d7680dd7d1a284f546d509a25d4a0e00d534733d23649c1904122.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2836	1988	6e0f22d3c54d7680dd7d1a284f546d509a25d4a0e00d534733d23649c1904122.exe	29
PID 1988 wrote to memory of 2836	1988	6e0f22d3c54d7680dd7d1a284f546d509a25d4a0e00d534733d23649c1904122.exe	29
PID 1988 wrote to memory of 2836	1988	6e0f22d3c54d7680dd7d1a284f546d509a25d4a0e00d534733d23649c1904122.exe	29

C:\Users\Admin\AppData\Local\Temp\6e0f22d3c54d7680dd7d1a284f546d509a25d4a0e00d534733d23649c1904122.exe
"C:\Users\Admin\AppData\Local\Temp\6e0f22d3c54d7680dd7d1a284f546d509a25d4a0e00d534733d23649c1904122.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\onefile_1988_133533110646538000\test.exe
  "C:\Users\Admin\AppData\Local\Temp\6e0f22d3c54d7680dd7d1a284f546d509a25d4a0e00d534733d23649c1904122.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_1988_133533110646538000\python39.dll

Filesize
4.3MB

MD5
2135da9f78a8ef80850fa582df2c7239

SHA1
aac6ad3054de6566851cae75215bdeda607821c4

SHA256
324963a39b8fd045ff634bb3271508dab5098b4d99e85e7648d0b47c32dc85c3

SHA512
423b03990d6aa9375ce10e6b62ffdb7e1e2f20a62d248aac822eb9d973ae2bf35deddd2550a4a0e17c51ad9f1e4f86443ca8f94050e0986daa345d30181a2369

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_1988_133533110646538000\test.exe

Filesize
8.7MB

MD5
41d138bbf8c88b768893f1e3780ce8ce

SHA1
f40316b43a5ae05a57912dcc3e2b85f8c13dd49f

SHA256
5792e9ff47f6406510f874b8057db827b82e07f7e5b7857454530c0e9170c13f

SHA512
3105670955b9d3ed56c0411ac3d8cb343a187b33def36915e3aa9ecf0e15603c5246541acfe275a458c7f682d28c6f399b582342d120e8e0ff76e75ed8d0d1c6

Download Submit
memory/1988-20-0x0000000077730000-0x0000000077732000-memory.dmp

Filesize
8KB

Download
memory/1988-2-0x0000000077700000-0x0000000077702000-memory.dmp

Filesize
8KB

Download
memory/1988-6-0x0000000077710000-0x0000000077712000-memory.dmp

Filesize
8KB

Download
memory/1988-8-0x0000000077710000-0x0000000077712000-memory.dmp

Filesize
8KB

Download
memory/1988-10-0x0000000077710000-0x0000000077712000-memory.dmp

Filesize
8KB

Download
memory/1988-11-0x0000000077720000-0x0000000077722000-memory.dmp

Filesize
8KB

Download
memory/1988-13-0x0000000077720000-0x0000000077722000-memory.dmp

Filesize
8KB

Download
memory/1988-15-0x0000000077720000-0x0000000077722000-memory.dmp

Filesize
8KB

Download
memory/1988-16-0x0000000077730000-0x0000000077732000-memory.dmp

Filesize
8KB

Download
memory/1988-18-0x0000000077730000-0x0000000077732000-memory.dmp

Filesize
8KB

Download
memory/1988-140-0x000000013F800000-0x0000000141084000-memory.dmp

Filesize
24.5MB

Download
memory/1988-5-0x0000000077700000-0x0000000077702000-memory.dmp

Filesize
8KB

Download
memory/1988-30-0x000007FEFD450000-0x000007FEFD452000-memory.dmp

Filesize
8KB

Download
memory/1988-28-0x000007FEFD450000-0x000007FEFD452000-memory.dmp

Filesize
8KB

Download
memory/1988-25-0x000007FEFD440000-0x000007FEFD442000-memory.dmp

Filesize
8KB

Download
memory/1988-31-0x0000000077740000-0x0000000077742000-memory.dmp

Filesize
8KB

Download
memory/1988-33-0x0000000077740000-0x0000000077742000-memory.dmp

Filesize
8KB

Download
memory/1988-35-0x0000000077740000-0x0000000077742000-memory.dmp

Filesize
8KB

Download
memory/1988-37-0x0000000077550000-0x00000000776F9000-memory.dmp

Filesize
1.7MB

Download
memory/1988-36-0x000000013F800000-0x0000000141084000-memory.dmp

Filesize
24.5MB

Download
memory/1988-4-0x000000013F800000-0x0000000141084000-memory.dmp

Filesize
24.5MB

Download
memory/1988-23-0x000007FEFD440000-0x000007FEFD442000-memory.dmp

Filesize
8KB

Download
memory/1988-141-0x0000000077550000-0x00000000776F9000-memory.dmp

Filesize
1.7MB

Download
memory/1988-0-0x0000000077700000-0x0000000077702000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing