stealc | 157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe
Size

446KB
MD5

d9f3edd22666d0238123a43a5336deef
SHA1

7712f92092557e62bff3c89756e78f564187df4b
SHA256

157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37
SHA512

8bf6facf19d441cbe620e664cc968e0c331b68e8f074df711befdddfb5fb2d7dc74bb27bb2782a73d4bc9b78862cde1443f1a246d6de3b23842c9014751b5948
SSDEEP

6144:6ElKzhA3pzBB5Xhc1q9aZQ2mYJ1ok/gkkxWZXG0c4I+QXjQgF:2zhOzB7kZQPYJ1LgOa4IjQgF

Score

10^/10

stealc stealer

Malware Config

Extracted

Family

stealc

http://185.172.128.209

Attributes

url_path
/3cd2b41cbde8fc9c.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe

Executes dropped EXE 4 IoCs

Processes:

u2mo.0.exeQg_Appv5.exeUniversalInstaller.exeUniversalInstaller.exe

pid process

4824 u2mo.0.exe
2436 Qg_Appv5.exe
2232 UniversalInstaller.exe
1944 UniversalInstaller.exe
Loads dropped DLL 4 IoCs

Processes:

UniversalInstaller.exeUniversalInstaller.exe

pid process

2232 UniversalInstaller.exe
2232 UniversalInstaller.exe
1944 UniversalInstaller.exe
1944 UniversalInstaller.exe

pid	process
4824	u2mo.0.exe
2436	Qg_Appv5.exe
2232	UniversalInstaller.exe
1944	UniversalInstaller.exe

pid	process
2232	UniversalInstaller.exe
2232	UniversalInstaller.exe
1944	UniversalInstaller.exe
1944	UniversalInstaller.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exeUniversalInstaller.exe

description	pid	process	target process
PID 404 set thread context of 3408	404	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe
PID 1944 set thread context of 3236	1944	UniversalInstaller.exe	cmd.exe

Drops file in Windows directory 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Windows\Tasks\GS_Debug.job cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1668 4824 WerFault.exe u2mo.0.exe

description	ioc	process
File created	C:\Windows\Tasks\GS_Debug.job	cmd.exe

pid	pid_target	process	target process
1668	4824	WerFault.exe	u2mo.0.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

Qg_Appv5.exeUniversalInstaller.exeUniversalInstaller.execmd.exe

pid	process
2436	Qg_Appv5.exe
2436	Qg_Appv5.exe
2436	Qg_Appv5.exe
2436	Qg_Appv5.exe
2232	UniversalInstaller.exe
1944	UniversalInstaller.exe
1944	UniversalInstaller.exe
3236	cmd.exe
3236	cmd.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

UniversalInstaller.exe

pid process

1944 UniversalInstaller.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

Qg_Appv5.exeUniversalInstaller.exeUniversalInstaller.exe

pid process

2436 Qg_Appv5.exe
2232 UniversalInstaller.exe
2232 UniversalInstaller.exe
1944 UniversalInstaller.exe
1944 UniversalInstaller.exe

pid	process
1944	UniversalInstaller.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exeQg_Appv5.exeUniversalInstaller.exeUniversalInstaller.exe

description	pid	process	target process
PID 404 wrote to memory of 3408	404	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe
PID 404 wrote to memory of 3408	404	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe
PID 404 wrote to memory of 3408	404	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe
PID 404 wrote to memory of 3408	404	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe
PID 404 wrote to memory of 3408	404	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe
PID 404 wrote to memory of 3408	404	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe
PID 404 wrote to memory of 3408	404	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe
PID 404 wrote to memory of 3408	404	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe
PID 404 wrote to memory of 3408	404	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe
PID 404 wrote to memory of 3408	404	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe
PID 3408 wrote to memory of 4824	3408	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe	u2mo.0.exe
PID 3408 wrote to memory of 4824	3408	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe	u2mo.0.exe
PID 3408 wrote to memory of 4824	3408	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe	u2mo.0.exe
PID 3408 wrote to memory of 2436	3408	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe	Qg_Appv5.exe
PID 3408 wrote to memory of 2436	3408	157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe	Qg_Appv5.exe
PID 2436 wrote to memory of 2232	2436	Qg_Appv5.exe	UniversalInstaller.exe
PID 2436 wrote to memory of 2232	2436	Qg_Appv5.exe	UniversalInstaller.exe
PID 2436 wrote to memory of 2232	2436	Qg_Appv5.exe	UniversalInstaller.exe
PID 2232 wrote to memory of 1944	2232	UniversalInstaller.exe	UniversalInstaller.exe
PID 2232 wrote to memory of 1944	2232	UniversalInstaller.exe	UniversalInstaller.exe
PID 2232 wrote to memory of 1944	2232	UniversalInstaller.exe	UniversalInstaller.exe
PID 1944 wrote to memory of 3236	1944	UniversalInstaller.exe	cmd.exe
PID 1944 wrote to memory of 3236	1944	UniversalInstaller.exe	cmd.exe
PID 1944 wrote to memory of 3236	1944	UniversalInstaller.exe	cmd.exe
PID 1944 wrote to memory of 3236	1944	UniversalInstaller.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe
"C:\Users\Admin\AppData\Local\Temp\157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:404

C:\Users\Admin\AppData\Local\Temp\157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe
"C:\Users\Admin\AppData\Local\Temp\157386601c8d17122127317f13148e59455e2805eb4387c77269466959cf8d37.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3408

C:\Users\Admin\AppData\Local\Temp\u2mo.0.exe
"C:\Users\Admin\AppData\Local\Temp\u2mo.0.exe"
3⤵
- Executes dropped EXE
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 1280
4⤵
- Program crash
PID:1668

C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
"C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436

C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232

C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
6⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4824 -ip 4824
1⤵
PID:4180

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Canon_Inc_IC\UniversalInstaller\ServiceLog\CANON_UIX_SERVICELOG_20240420114259.TXT
Filesize
455B

MD5
23a6f4d296cc2684d1334f675049ff3c

SHA1
caf11ebbc616977b05f5bca0f8d34d397dac38f8

SHA256
1d7e5e20249f75ff0a0fe7f1120d1fc70c89d0ff7e6defad51945c4ec6c5659e

SHA512
cf9538350a5f3653a80b5fc5d626ae6750047e32fe2f60f48eb1676217c677508369ad85cb4084ac4b76ca031fe543af3bd98b898a8e552659e48ad8421309f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\78c98d37
Filesize
5.9MB

MD5
dcc26dd014bad9eafa9066d3781b615d

SHA1
b0cb8621ca58a196ac73bed4e525deacfaf2d836

SHA256
69502ffc7e2b8946d420e682cd1421f58a17f489590f761c580ce2a4feb74ae3

SHA512
5a7804fdebe09aada86e327899fa7ce6830c26c426d398dd72ef68121c33e59c2572709a725f43d6f1d31c52e7b4ea10b2128d00d530a00ef9db9a8efef204e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\8482980e
Filesize
1.4MB

MD5
95677be0e8e80ce548c4727608dbf3da

SHA1
b226cf97c6afb4f01d3555659cbd382e3e355bd0

SHA256
a4b5e64829642f7d4e0b29c9ea9d7091f31ae9122c9f2ae878f7362fd4e49968

SHA512
f988de4370148ccb684a206583d15b4c767b4747c2bcedc57b50d7fca7ad0db21ae4f44364ff30dafb703f81449b653d212b6b4e065a2840061a488cb086c912

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
Filesize
14.7MB

MD5
6955715b6ff15bdc153a2431cc395cca

SHA1
272e1eec66a1871b300484b2200b507a4abe5420

SHA256
a6d40169be9c151e9e6c86fe53d2bac3b4c2ddb41c0b650d961f8328939b4761

SHA512
cf82d27d7010be69ab1c288fef9d820905407c8018e2a91f3c39a0eda5e9378e0ff04d077520d556d46d7a9cb0a3a640d15a10ad4090e482be3c83930836019d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UIxMarketPlugin.dll
Filesize
1.6MB

MD5
8f75e17a8bf3de6e22e77b5586f8a869

SHA1
e0bf196cfc19a8772e003b9058bdc211b419b261

SHA256
5f10a9fdcac32e93b1cebc365868ee3266f80c2734524b4aa7b6ea54e123f985

SHA512
5a1e78613ad90cb0dc855d8a935b136722749889b66d4d8fc0f52438f0a4f4c8c31fbb981e9c6a13ffb2cc2b77fe0747204b63a91c6fff4646eed915387c8d7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
Filesize
2.4MB

MD5
9fb4770ced09aae3b437c1c6eb6d7334

SHA1
fe54b31b0db8665aa5b22bed147e8295afc88a03

SHA256
a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

SHA512
140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\relay.dll
Filesize
1.5MB

MD5
7d2f87123e63950159fb2c724e55bdab

SHA1
360f304a6311080e1fead8591cb4659a8d135f2d

SHA256
b3483bb771948ed8d3f76faaa3606c8ef72e3d2d355eaa652877e21e0651aa9a

SHA512
6cb8d27ebcfdf9e472c0a6fff86e6f4ec604b8f0f21c197ba6d5b76b703296c10c8d7c4fb6b082c7e77f5c35d364bcffd76ae54137e2c8944c1ea7bb9e2e5f08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\somebody.rtf
Filesize
24KB

MD5
ff36ebcf134c8846aea77446867e5bc6

SHA1
53fdf2c0bec711e377edb4f97cd147728fb568f6

SHA256
e1c256e5a7f17cb64740223084009f37bddccc49b05e881133412057689b04e9

SHA512
b07d5065dd39843c8c7bdfccdd8d39f44b1ce9fe100a2fcf7210549ea1d46bcac54080cf91eff0a05360b26233c542daabdbd5d3f096a5bf0e366583ddb29ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\spawn.xml
Filesize
1.3MB

MD5
2d8de35aa00138b2bfc4fb0fc3d0f58b

SHA1
28c2d84e01815702c230da456aaa17c7d2519186

SHA256
19340e9202db71d8010563c8b8d325cbef5d8448a8df2ad730e74a5a46e36dac

SHA512
378116bc71de9f968aaef6ca27944e341a9a825a92831f5834c396160581f5e3656d3b6d1c2a304a65a74c0dd9ca0c50fb0e0016b6174d1fab68909ea1c95128

Download Submit
C:\Users\Admin\AppData\Local\Temp\u2mo.0.exe
Filesize
301KB

MD5
c29668ce95a27f1c0d75fa0fc655a607

SHA1
b3b74ed89d35278b107e6fac664f18b5331c6d9c

SHA256
074ca02b095dd13e430466b7380205a28ed2015f208ebee9802fce84ae2202fa

SHA512
9d60dd3d2384c19dd14bc905969fd5815b313e631a82af3bd0e2db938f593c5f493bc71e95f0ca0d83416d5a03159d61c6da3d8c6e10b4b81a6443710e5ab5b4

Download Submit
memory/404-1-0x0000000001CD0000-0x0000000001DD0000-memory.dmp

Filesize
1024KB

Download
memory/404-2-0x00000000037B0000-0x000000000381F000-memory.dmp

Filesize
444KB

Download
memory/1944-93-0x00007FF8289F0000-0x00007FF828BE5000-memory.dmp

Filesize
2.0MB

Download
memory/1944-94-0x0000000072890000-0x0000000072A0B000-memory.dmp

Filesize
1.5MB

Download
memory/1944-92-0x0000000072890000-0x0000000072A0B000-memory.dmp

Filesize
1.5MB

Download
memory/1944-97-0x0000000072890000-0x0000000072A0B000-memory.dmp

Filesize
1.5MB

Download
memory/2232-76-0x00007FF8289F0000-0x00007FF828BE5000-memory.dmp

Filesize
2.0MB

Download
memory/2232-75-0x0000000072890000-0x0000000072A0B000-memory.dmp

Filesize
1.5MB

Download
memory/2436-46-0x00000201D07C0000-0x00000201D07C1000-memory.dmp

Filesize
4KB

Download
memory/2436-47-0x00000000000D0000-0x0000000000FAD000-memory.dmp

Filesize
14.9MB

Download
memory/2436-53-0x00007FF80A0C0000-0x00007FF80A232000-memory.dmp

Filesize
1.4MB

Download
memory/2436-55-0x00007FF80A0C0000-0x00007FF80A232000-memory.dmp

Filesize
1.4MB

Download
memory/2436-95-0x00007FF80A0C0000-0x00007FF80A232000-memory.dmp

Filesize
1.4MB

Download
memory/2436-65-0x00007FF80A0C0000-0x00007FF80A232000-memory.dmp

Filesize
1.4MB

Download
memory/3236-99-0x0000000072890000-0x0000000072A0B000-memory.dmp

Filesize
1.5MB

Download
memory/3236-104-0x0000000072890000-0x0000000072A0B000-memory.dmp

Filesize
1.5MB

Download
memory/3236-102-0x0000000072890000-0x0000000072A0B000-memory.dmp

Filesize
1.5MB

Download
memory/3236-101-0x00007FF8289F0000-0x00007FF828BE5000-memory.dmp

Filesize
2.0MB

Download
memory/3408-58-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3408-23-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3408-6-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3408-5-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3408-4-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3408-3-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4824-22-0x0000000000400000-0x0000000001A16000-memory.dmp

Filesize
22.1MB

Download
memory/4824-21-0x0000000000400000-0x0000000001A16000-memory.dmp

Filesize
22.1MB

Download
memory/4824-19-0x0000000001AA0000-0x0000000001BA0000-memory.dmp

Filesize
1024KB

Download
memory/4824-20-0x0000000001BB0000-0x0000000001BD7000-memory.dmp

Filesize
156KB

Download