Analysis
- max time kernel
93s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
12/06/2024, 22:31
General
- Target 63079f34-b294-4790-bfd5-bbad82995295/snss1.exe
- Size 2.5MB
- Sample240612-2fg1vstamb
- SHA256 fbce9f6897452177133b628f8dcd289564c3d28428cdcd2cbed519d9b8724b07
Malware Config
Extracted
-
stealc
-
vor11
-
http://45.132.105.157
-
url_path
/eb155c7506e03ca9.php
Signatures
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
- HijackLoader
HijackLoader is a multistage loader first seen in 2023.
- Stealc
Stealc is an infostealer written in C++.
- Downloads MZ/PE file
- Deletes itself 1 IoCs
- Loads dropped DLL 2 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\63079f34-b294-4790-bfd5-bbad82995295\snss1.exe"C:\Users\Admin\AppData\Local\Temp\63079f34-b294-4790-bfd5-bbad82995295\snss1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
a9f559d8
memory/2456-0-0x0000000000400000-0x0000000000693000-memory.dmp
memory/2456-1-0x00000000748D0000-0x0000000074A4B000-memory.dmp
memory/2456-2-0x00007FFE558D0000-0x00007FFE55AC5000-memory.dmp
memory/2456-3-0x00000000748E2000-0x00000000748E4000-memory.dmp
memory/2456-4-0x00000000748D0000-0x0000000074A4B000-memory.dmp
memory/2456-5-0x00000000748D0000-0x0000000074A4B000-memory.dmp
memory/2552-11-0x00000000748D0000-0x0000000074A4B000-memory.dmp
memory/2552-10-0x00000000748D0000-0x0000000074A4B000-memory.dmp
memory/2552-13-0x00000000748D0000-0x0000000074A4B000-memory.dmp
memory/2552-9-0x00007FFE558D0000-0x00007FFE55AC5000-memory.dmp
memory/2552-7-0x00000000748D0000-0x0000000074A4B000-memory.dmp
memory/3188-14-0x00000000008A0000-0x0000000000ADE000-memory.dmp
memory/3188-15-0x00007FFE558D0000-0x00007FFE55AC5000-memory.dmp
memory/3188-16-0x00000000008A0000-0x0000000000ADE000-memory.dmp
memory/3188-19-0x0000000000243000-0x000000000024B000-memory.dmp
memory/3188-20-0x0000000000160000-0x0000000000593000-memory.dmp
memory/3188-21-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/3188-63-0x00000000008A0000-0x0000000000ADE000-memory.dmp
memory/3188-92-0x00000000008A0000-0x0000000000ADE000-memory.dmp