Overview

overview

10

Static

static

3

HEUR-Troja...rc.exe

windows7-x64

10

HEUR-Troja...rc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/02/2024, 07:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    HEUR-Trojan-PSW.Win32.Stealerc.exe

  • Size

    266KB

  • MD5

    02eca8b6bd45021eaac8835f9c9548f7

  • SHA1

    be78b953935d7be462fdc8b021c11920eb4a4b41

  • SHA256

    8aed005dd9550cc097fa8a5bf33d6c9a68853c7a6b2cd8ecf9a83e136f18513c

  • SHA512

    d7316dfcfe28852314a7fe2a93b0a4e7bada5a6c1014f483e5b82c06f594b94837d965fde2c35ea0c9579ff64307562a761370b0b3e1735ab2902b4b2408dd17

  • SSDEEP

    3072:4p/MaLzNQDz6j9h0sTyuCOPraR2vcMRMc1bItu1W2y1XMc5EKK2T77a:IpNQSj9pCC42UMbpIE1W24aN2T

Score
10/10
stealcstealer

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.24

Attributes
  • url_path

    /f993692117a3fda2.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-PSW.Win32.Stealerc.exe
    "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-PSW.Win32.Stealerc.exe"
    1⤵
      PID:5220
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 336
        2⤵
        • Program crash
        PID:4104
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5220 -ip 5220
      1⤵
        PID:3828

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/5220-1-0x0000000002FD0000-0x00000000030D0000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/5220-2-0x0000000002EF0000-0x0000000002F24000-memory.dmp

              Filesize

              208KB

              Download

            • memory/5220-3-0x0000000000400000-0x0000000002D41000-memory.dmp

              Filesize

              41.3MB

              Download

            • memory/5220-4-0x0000000000400000-0x0000000002D41000-memory.dmp

              Filesize

              41.3MB

              Download

            • memory/5220-5-0x0000000002EF0000-0x0000000002F24000-memory.dmp

              Filesize

              208KB

              Download