stealc | eeaa177b0bc2d85cf8b416c2ed3b85fd50bd7c811bf41a32d161a10a767c2fda

Analysis

max time kernel
114s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f85ca7da4201921c93b98f6555f3d7b7.exe
Size

226KB
MD5

f85ca7da4201921c93b98f6555f3d7b7
SHA1

523891e3e23bb45a52e402b6282f70f9e17cde9c
SHA256

eeaa177b0bc2d85cf8b416c2ed3b85fd50bd7c811bf41a32d161a10a767c2fda
SHA512

1b8220fe954799fbc43a702a1c508beff390c3f5a58e8e50e3c5ccce48459ec3a25df395f041f722cb67b0eb6c31013239f58a8b947e60344d15ce0c56e9cb17
SSDEEP

3072:kpvTZ/uFMUVza2N0PHPJvIHtI0Eo8552iIwuNLuB:kpvT0Za2N0PxMtI0ENiiIZNLu

Score

10^/10

stealc discovery stealer

Malware Config

Extracted

Family

stealc

http://185.172.128.62

Attributes

url_path
/902e53a07830e030.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3308 908 WerFault.exe f85ca7da4201921c93b98f6555f3d7b7.exe

pid	pid_target	process	target process
3308	908	WerFault.exe	f85ca7da4201921c93b98f6555f3d7b7.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f85ca7da4201921c93b98f6555f3d7b7.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	f85ca7da4201921c93b98f6555f3d7b7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	f85ca7da4201921c93b98f6555f3d7b7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f85ca7da4201921c93b98f6555f3d7b7.exe

pid process

908 f85ca7da4201921c93b98f6555f3d7b7.exe
908 f85ca7da4201921c93b98f6555f3d7b7.exe

pid	process
908	f85ca7da4201921c93b98f6555f3d7b7.exe
908	f85ca7da4201921c93b98f6555f3d7b7.exe

C:\Users\Admin\AppData\Local\Temp\f85ca7da4201921c93b98f6555f3d7b7.exe
"C:\Users\Admin\AppData\Local\Temp\f85ca7da4201921c93b98f6555f3d7b7.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 1308
2⤵
- Program crash
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 908 -ip 908
1⤵
PID:2964

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/908-1-0x00000000009B0000-0x0000000000AB0000-memory.dmp

Filesize
1024KB

Download
memory/908-3-0x0000000000400000-0x000000000083A000-memory.dmp

Filesize
4.2MB

Download
memory/908-2-0x00000000008C0000-0x00000000008E7000-memory.dmp

Filesize
156KB

Download
memory/908-4-0x0000000000400000-0x000000000083A000-memory.dmp

Filesize
4.2MB

Download
memory/908-5-0x00000000009B0000-0x0000000000AB0000-memory.dmp

Filesize
1024KB

Download
memory/908-7-0x0000000000400000-0x000000000083A000-memory.dmp

Filesize
4.2MB

Download
memory/908-9-0x0000000000400000-0x000000000083A000-memory.dmp

Filesize
4.2MB

Download
memory/908-11-0x0000000000400000-0x000000000083A000-memory.dmp

Filesize
4.2MB

Download
memory/908-13-0x0000000000400000-0x000000000083A000-memory.dmp

Filesize
4.2MB

Download