stealc | d015aabe92f1a3208a3e0b6ebaf85a3def932a24fb133bb7c051dc3768af4810

General

Target
d015aabe92f1a3208a3e0b6ebaf85a3def932a24fb133bb7c051dc3768af4810.exe
Size 254KB
Sample240607-b4mm5sgf48
SHA256 d015aabe92f1a3208a3e0b6ebaf85a3def932a24fb133bb7c051dc3768af4810
MD5 0a1857343ebdb2c191d872e444fad837
SHA1 975c4cf503b6322faecbf739db0dba5172819203
SHA512 70416729fb19cda79acfd969ce19de0953edd26caf8db20d12e576aa26b97b37a9cb09862562e88d87a77bdd6ef19977a70fe8edfa92ad35e61725b896a9468b
SSDEEP 3072:WPdL6Xit6oa0QyUOtowQauVw8MhvcM4CT5AqUQZ5XH3A7H3A4/IVE:CdL6Xi0/0loI78MhkM5yqUQ73Az3AHE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc default12 discovery spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

default12

C2

http://185.172.128.170

Attributes

url_path
/7043a0c6a68d9c65.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
4892	d015aabe92f1a3208a3e0b6ebaf85a3def932a24fb133bb7c051dc3768af4810.exe
4892	d015aabe92f1a3208a3e0b6ebaf85a3def932a24fb133bb7c051dc3768af4810.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d015aabe92f1a3208a3e0b6ebaf85a3def932a24fb133bb7c051dc3768af4810.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	d015aabe92f1a3208a3e0b6ebaf85a3def932a24fb133bb7c051dc3768af4810.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4892	d015aabe92f1a3208a3e0b6ebaf85a3def932a24fb133bb7c051dc3768af4810.exe
4892	d015aabe92f1a3208a3e0b6ebaf85a3def932a24fb133bb7c051dc3768af4810.exe

C:\Users\Admin\AppData\Local\Temp\d015aabe92f1a3208a3e0b6ebaf85a3def932a24fb133bb7c051dc3768af4810.exe
"C:\Users\Admin\AppData\Local\Temp\d015aabe92f1a3208a3e0b6ebaf85a3def932a24fb133bb7c051dc3768af4810.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4892
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\DHIJDHIDBG.exe"
  2⤵
  PID:3812
- - C:\Users\Admin\AppData\Local\Temp\DHIJDHIDBG.exe
    "C:\Users\Admin\AppData\Local\Temp\DHIJDHIDBG.exe"
    3⤵
    PID:884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Are.docx

Path C:\ProgramData\Are.docx
Size 11KB
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
SSDEEP 192:CtNCEE33S7Ok0CMSYbcBVk6tqM16iPBkeawLWdxd7o3Lp:aNwC78uYbcBv6akwLWdxdE3Lp
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 448KB
SHA256 92df8a625452746acfbe72ccc5242d15a0e2985ba7ca9e6ea105561cc1d4d239
MD5 d9cc66ccf417e3644524a76ed74ad577
SHA1 441d703591a55883c496985fe95e51f1d109fa5c
SHA512 25c26a8b154d64f488d38e81e8818174d6733aea2392075977d4cf61dd00128f9114ddd0e0f0e43b8e456fd234dc5bc22fde097080147845e39538cc493f5252
SSDEEP 6144:iKflSyAomPnkYySd0/TYRKHGddwd9Ym4wFkUYwxoHu6D7Vaqntg49hDYo9RuTJE:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJE
MD5 SHA1 SHA512 SSDEEP

Submit Download

DHIJDHIDBG.exe

Path C:\Users\Admin\AppData\Local\Temp\DHIJDHIDBG.exe
Size 448KB
SHA256 b93ccbb425feba74a20e18bdf8a1e1166eec13349b9dc68409cff20cd3b973d6
MD5 1ccde92bc3ce9c6f8613edd734331edc
SHA1 e8281ea95be0acb6dff3f13d77130f687c06afd6
SHA512 196f140985878db91f833d5d3bd4304d482f384b4b2e7edb773a6da0014a5d65bd15163bda3fad62a503559fa1d0b3ace6933d36f0f975fd46d0b272da8b3684
SSDEEP 6144:yU3iKBTO7hQqRGoFyLmVmH6Q4vwRuGuoBhYkuFqD:yU7UVGoFyLmVO6Q6wAGuoBhz
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path \ProgramData\nss3.dll
Size 1.9MB
SHA256 5110226be5822752077f259965f46aad25806764b6095c6e9339f23a3b5f3798
MD5 a37ec6fd63b1d70d3d6206a292be1d51
SHA1 cb5cdc36817f08ec07318ca9278430f329fb4b14
SHA512 89a4cc6c10693138e1c965de593ea03f81601ca13d43de29899963a2d7319501c5f83b932ab884734da6d7b076ed53238310883596bb4e15973976dc99191746
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzC:J7Tf8J1Q+SS5/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4892-1-0x00007FFCAF150000-0x00007FFCAF32B000-memory.dmp

Download

memory/4892-2-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4892-67-0x0000000000400000-0x0000000001BB9000-memory.dmp

Download

memory/4892-75-0x0000000000400000-0x0000000001BB9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads