stealc | 5d4cd79354570270f52c6647993ab42b00ab3f388d9503b4104286d1497caba1

Analysis

max time kernel
141s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
20/04/2024, 21:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5d4cd79354570270f52c6647993ab42b00ab3f388d9503b4104286d1497caba1.exe
Size

444KB
MD5

a977f50dd4332125e5549da181e1b6c4
SHA1

f08301780e4a044345cf9d513adacef57058ef7b
SHA256

5d4cd79354570270f52c6647993ab42b00ab3f388d9503b4104286d1497caba1
SHA512

049c66eabad487eb262a27de3d7efd3e77c35ed7196e34d58b79472c0c4b153cc104ae85adfce2a45bf58bbd42bc7fd9d01a75ecdd1acbe63b654cff8c9b9dba
SSDEEP

6144:lxizvP+H1OFMqWaVocJ5b8R6WkRYHtyqr7RWoP:z+vmH6xWaVxJ5IR6WBFrtWoP

Score

10^/10

stealc stealer

Malware Config

Extracted

Family

stealc

http://185.172.128.209

Attributes

url_path
/3cd2b41cbde8fc9c.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4848	u2hs.0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4044	4848	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 4848	3232	5d4cd79354570270f52c6647993ab42b00ab3f388d9503b4104286d1497caba1.exe	81
PID 3232 wrote to memory of 4848	3232	5d4cd79354570270f52c6647993ab42b00ab3f388d9503b4104286d1497caba1.exe	81
PID 3232 wrote to memory of 4848	3232	5d4cd79354570270f52c6647993ab42b00ab3f388d9503b4104286d1497caba1.exe	81

C:\Users\Admin\AppData\Local\Temp\5d4cd79354570270f52c6647993ab42b00ab3f388d9503b4104286d1497caba1.exe
"C:\Users\Admin\AppData\Local\Temp\5d4cd79354570270f52c6647993ab42b00ab3f388d9503b4104286d1497caba1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Users\Admin\AppData\Local\Temp\u2hs.0.exe
  "C:\Users\Admin\AppData\Local\Temp\u2hs.0.exe"
  2⤵
  - Executes dropped EXE
  PID:4848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 1244
    3⤵
    - Program crash
    PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4848 -ip 4848
1⤵
PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\u2hs.0.exe

Filesize
300KB

MD5
1aeebe06fed542fe9e22ef0775bbbc9e

SHA1
f28e27a06c1e3087b336547c1c2ede1dcf01731c

SHA256
d06ac89e4fbcde900df6b1befc193cd37d23c4fbb409bc449d1cb4abbe733645

SHA512
576a2a27c14129fecae248163f2e9be31ec0bf5977da5566751b01e632231acfcf3e5905bbef5bf2a3d8b8be5468b84cca2b0faacc787da616f136fb51df1c56

Download Submit
memory/3232-12-0x0000000074E60000-0x0000000074E71000-memory.dmp

Filesize
68KB

Download
memory/3232-3-0x0000000000400000-0x0000000001A3A000-memory.dmp

Filesize
22.2MB

Download
memory/3232-5-0x0000000001C90000-0x0000000001D90000-memory.dmp

Filesize
1024KB

Download
memory/3232-7-0x0000000000400000-0x0000000001A3A000-memory.dmp

Filesize
22.2MB

Download
memory/3232-9-0x0000000074F90000-0x0000000074FA2000-memory.dmp

Filesize
72KB

Download
memory/3232-1-0x0000000001C90000-0x0000000001D90000-memory.dmp

Filesize
1024KB

Download
memory/3232-13-0x0000000074E40000-0x0000000074E59000-memory.dmp

Filesize
100KB

Download
memory/3232-2-0x00000000038B0000-0x000000000391E000-memory.dmp

Filesize
440KB

Download
memory/3232-30-0x0000000000400000-0x0000000001A3A000-memory.dmp

Filesize
22.2MB

Download
memory/4848-26-0x0000000001BB0000-0x0000000001CB0000-memory.dmp

Filesize
1024KB

Download
memory/4848-27-0x0000000001B80000-0x0000000001BA7000-memory.dmp

Filesize
156KB

Download
memory/4848-28-0x0000000000400000-0x0000000001A16000-memory.dmp

Filesize
22.1MB

Download
memory/4848-29-0x0000000000400000-0x0000000001A16000-memory.dmp

Filesize
22.1MB

Download