stealthworker | 6a8338da3d4fd6371ce3eb8eac02be1f91552e72aa0556e1a8579473e6025ec7

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42f2b39a182b0603d128ffab24cfbf26_JaffaCakes118.exe
Size

2.2MB
MD5

42f2b39a182b0603d128ffab24cfbf26
SHA1

ac730171506124495fb4e5980d2be7e61cd1c0e3
SHA256

6a8338da3d4fd6371ce3eb8eac02be1f91552e72aa0556e1a8579473e6025ec7
SHA512

8d501c4fafd6af98c6468959f6d3c92b8a32557e41551a2a949e8db08716e27a18b83aa3b861d5ef75aaef139bdb089fe9cc868c53bfaf3ce20f2a40992088bf
SSDEEP

49152:BEx3tccKc8CWp7yTTSNyCsQ6fXa9mBcb0f+oOLyZlbh1fa:iFttKtbpIc8goJOMFb

Score

10^/10

stealthworker botnet

Malware Config

Extracted

Family

stealthworker

Version

3.12

http://91.240.118.73:8888

Signatures

StealthWorker
StealthWorker is golang-based brute force malware.
botnet stealthworker

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskvhost.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskvhost.exe	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 3492	2696	42f2b39a182b0603d128ffab24cfbf26_JaffaCakes118.exe	85
PID 2696 wrote to memory of 3492	2696	42f2b39a182b0603d128ffab24cfbf26_JaffaCakes118.exe	85
PID 2696 wrote to memory of 3492	2696	42f2b39a182b0603d128ffab24cfbf26_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\42f2b39a182b0603d128ffab24cfbf26_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\42f2b39a182b0603d128ffab24cfbf26_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\cmd.exe
  cmd /Q /C C:\Users\Admin\AppData\Local\Temp/s.bat
  2⤵
  - Drops startup file
  PID:3492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\s.bat

Filesize
305B

MD5
3fe0bd51ded8c4aa2526a268eed81bb8

SHA1
e5cfb1ead6c8c3c66d00364c94e0fb2031686252

SHA256
621c0a509ff7aff19b4322a817ebf1d9910735bdbce99bf9f86b81f41c23cd8d

SHA512
e7c9d3ce5be1945e2f9c7448aefacd17e535e270c2d0f7cacfd496fd16fc2923d7b7281d1a17228090cfeca454c0d18e50b83168e88590c2ab17322a6a02ea2a

Download Submit
memory/2696-12-0x0000000000400000-0x0000000000B2A000-memory.dmp

Filesize
7.2MB

Download
memory/2696-15-0x0000000000400000-0x0000000000B2A000-memory.dmp

Filesize
7.2MB

Download
memory/2696-7-0x0000000000400000-0x0000000000B2A000-memory.dmp

Filesize
7.2MB

Download
memory/2696-8-0x0000000000400000-0x0000000000B2A000-memory.dmp

Filesize
7.2MB

Download
memory/2696-9-0x0000000002A50000-0x0000000003178000-memory.dmp

Filesize
7.2MB

Download
memory/2696-10-0x0000000000400000-0x0000000000B28000-memory.dmp

Filesize
7.2MB

Download
memory/2696-11-0x0000000000400000-0x0000000000B2A000-memory.dmp

Filesize
7.2MB

Download
memory/2696-0-0x0000000002A50000-0x0000000003178000-memory.dmp

Filesize
7.2MB

Download
memory/2696-1-0x0000000000400000-0x0000000000B28000-memory.dmp

Filesize
7.2MB

Download
memory/2696-13-0x0000000000400000-0x0000000000B2A000-memory.dmp

Filesize
7.2MB

Download
memory/2696-14-0x0000000000400000-0x0000000000B2A000-memory.dmp

Filesize
7.2MB

Download
memory/2696-16-0x0000000000400000-0x0000000000B2A000-memory.dmp

Filesize
7.2MB

Download
memory/2696-17-0x0000000000400000-0x0000000000B2A000-memory.dmp

Filesize
7.2MB

Download
memory/2696-18-0x0000000000400000-0x0000000000B2A000-memory.dmp

Filesize
7.2MB

Download
memory/2696-19-0x0000000000400000-0x0000000000B2A000-memory.dmp

Filesize
7.2MB

Download
memory/2696-20-0x0000000000400000-0x0000000000B2A000-memory.dmp

Filesize
7.2MB

Download
memory/2696-21-0x0000000000400000-0x0000000000B2A000-memory.dmp

Filesize
7.2MB

Download
memory/2696-22-0x0000000000400000-0x0000000000B2A000-memory.dmp

Filesize
7.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads