stealc | 5d4cd79354570270f52c6647993ab42b00ab3f388d9503b4104286d1497caba1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 21:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5d4cd79354570270f52c6647993ab42b00ab3f388d9503b4104286d1497caba1.exe
Size

444KB
MD5

a977f50dd4332125e5549da181e1b6c4
SHA1

f08301780e4a044345cf9d513adacef57058ef7b
SHA256

5d4cd79354570270f52c6647993ab42b00ab3f388d9503b4104286d1497caba1
SHA512

049c66eabad487eb262a27de3d7efd3e77c35ed7196e34d58b79472c0c4b153cc104ae85adfce2a45bf58bbd42bc7fd9d01a75ecdd1acbe63b654cff8c9b9dba
SSDEEP

6144:lxizvP+H1OFMqWaVocJ5b8R6WkRYHtyqr7RWoP:z+vmH6xWaVxJ5IR6WBFrtWoP

Score

10^/10

stealc stealer

Malware Config

Extracted

Family

stealc

http://185.172.128.209

Attributes

url_path
/3cd2b41cbde8fc9c.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	5d4cd79354570270f52c6647993ab42b00ab3f388d9503b4104286d1497caba1.exe

Executes dropped EXE 1 IoCs

pid	Process
1956	u3w8.0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1116	1956	WerFault.exe	95

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 1956	5048	5d4cd79354570270f52c6647993ab42b00ab3f388d9503b4104286d1497caba1.exe	95
PID 5048 wrote to memory of 1956	5048	5d4cd79354570270f52c6647993ab42b00ab3f388d9503b4104286d1497caba1.exe	95
PID 5048 wrote to memory of 1956	5048	5d4cd79354570270f52c6647993ab42b00ab3f388d9503b4104286d1497caba1.exe	95

C:\Users\Admin\AppData\Local\Temp\5d4cd79354570270f52c6647993ab42b00ab3f388d9503b4104286d1497caba1.exe
"C:\Users\Admin\AppData\Local\Temp\5d4cd79354570270f52c6647993ab42b00ab3f388d9503b4104286d1497caba1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\u3w8.0.exe
  "C:\Users\Admin\AppData\Local\Temp\u3w8.0.exe"
  2⤵
  - Executes dropped EXE
  PID:1956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 1288
    3⤵
    - Program crash
    PID:1116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1956 -ip 1956
1⤵
PID:1576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\u3w8.0.exe

Filesize
300KB

MD5
1aeebe06fed542fe9e22ef0775bbbc9e

SHA1
f28e27a06c1e3087b336547c1c2ede1dcf01731c

SHA256
d06ac89e4fbcde900df6b1befc193cd37d23c4fbb409bc449d1cb4abbe733645

SHA512
576a2a27c14129fecae248163f2e9be31ec0bf5977da5566751b01e632231acfcf3e5905bbef5bf2a3d8b8be5468b84cca2b0faacc787da616f136fb51df1c56

Download Submit
memory/1956-20-0x0000000001B80000-0x0000000001BA7000-memory.dmp

Filesize
156KB

Download
memory/1956-19-0x0000000001BE0000-0x0000000001CE0000-memory.dmp

Filesize
1024KB

Download
memory/1956-21-0x0000000000400000-0x0000000001A16000-memory.dmp

Filesize
22.1MB

Download
memory/1956-22-0x0000000000400000-0x0000000001A16000-memory.dmp

Filesize
22.1MB

Download
memory/5048-1-0x0000000001C10000-0x0000000001D10000-memory.dmp

Filesize
1024KB

Download
memory/5048-2-0x00000000036B0000-0x000000000371E000-memory.dmp

Filesize
440KB

Download
memory/5048-3-0x0000000000400000-0x0000000001A3A000-memory.dmp

Filesize
22.2MB

Download
memory/5048-4-0x0000000000400000-0x0000000001A3A000-memory.dmp

Filesize
22.2MB

Download
memory/5048-5-0x0000000001C10000-0x0000000001D10000-memory.dmp

Filesize
1024KB

Download
memory/5048-23-0x0000000000400000-0x0000000001A3A000-memory.dmp

Filesize
22.2MB

Download