stealc | ddf2e55923edd038118e0ea6e7418d9a4960be4b33f8752b40515e204b495fcc

Analysis

max time kernel
91s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 13:14

Target

9120566b5096fc5643a1b64c2ef29fd034c245d52ec244cdf06b6e312e299acf.exe
Size

252KB
MD5

22b7e30240f2ba7b9f8dc28b8ca8a3e8
SHA1

e6ff3a623345ff800c3b5cfed45375face9c9a64
SHA256

9120566b5096fc5643a1b64c2ef29fd034c245d52ec244cdf06b6e312e299acf
SHA512

20fc8a81d5c3b1ce2abc243c5f046c999f7a904f065a5495334ec10a07fa60b0232c44b42cfb7a7319987852333997658fadc37b877d2d44449949b80d7d5f35
SSDEEP

6144:OvcdMCQi9IKtAEdht4fTPnVujyu7P7uHyl64:9dMCh9IKqEle5uT7uHc

Score

10^/10

stealc stealer

Family

stealc

http://185.172.128.26

Attributes

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

228 396 WerFault.exe 9120566b5096fc5643a1b64c2ef29fd034c245d52ec244cdf06b6e312e299acf.exe

pid	pid_target	process	target process
228	396	WerFault.exe	9120566b5096fc5643a1b64c2ef29fd034c245d52ec244cdf06b6e312e299acf.exe

C:\Users\Admin\AppData\Local\Temp\9120566b5096fc5643a1b64c2ef29fd034c245d52ec244cdf06b6e312e299acf.exe
"C:\Users\Admin\AppData\Local\Temp\9120566b5096fc5643a1b64c2ef29fd034c245d52ec244cdf06b6e312e299acf.exe"
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 1276
2⤵
- Program crash
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 396 -ip 396
1⤵
PID:4356

memory/396-1-0x0000000000710000-0x0000000000810000-memory.dmp

Filesize
1024KB

Download
memory/396-2-0x0000000002370000-0x0000000002397000-memory.dmp

Filesize
156KB

Download
memory/396-3-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/396-4-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download