stealc | 1916-172-0x0000000000CB0000-0x000000000189E000-memory[.]dmp

General

Target
1916-172-0x0000000000CB0000-0x000000000189E000-memory.dmp
Size 11.9MB
Sample240625-rf92jaxdln
SHA256 56caa981531084a5004b039e1342059a088320bb9252d24b431c25d7752811c7
MD5 37d8a37f9bbfcf2f701ab8b4abffec6a
SHA1 a3e503206cbb7c0f8029a1fd6a052dde43eeb3dd
SHA512 7619a68fdc1be1cea0750b66a092ba35b7a39a4e7be117dab565dd9dbc604c2efd73af350873132c2b656c659e58e8a0854e5fbe85254e95e00d4091370fe12b
SSDEEP 98304:0sn2L58YAWvkq7+YvCAUq5qE1g7xs+Gkqk7Zdo/8MPum7UpJDc:9nBgHZvCAth1g7x93jojIDc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

default stealc

Malware Config

Extracted

Family

stealc

Botnet

default

C2

http://85.28.47.4

Attributes

url_path
/920475a59bac849d.php

Signatures

Stealc family
stealc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1916-172-0x0000000000CB0000-0x000000000189E000-memory.dmp

File Explorer

1916-172-0x0000000000CB0000-0x000000000189E000-memory.dmp

.exe 11.9MB

1916-172-0x0000000000CB0000-0x000000000189E000-memory.dmp

SHA256 56caa981531084a5004b039e1342059a088320bb9252d24b431c25d7752811c7
MD5 37d8a37f9bbfcf2f701ab8b4abffec6a
SHA1 a3e503206cbb7c0f8029a1fd6a052dde43eeb3dd
SHA512 7619a68fdc1be1cea0750b66a092ba35b7a39a4e7be117dab565dd9dbc604c2efd73af350873132c2b656c659e58e8a0854e5fbe85254e95e00d4091370fe12b
SSDEEP 98304:0sn2L58YAWvkq7+YvCAUq5qE1g7xs+Gkqk7Zdo/8MPum7UpJDc:9nBgHZvCAth1g7x93jojIDc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12503580

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

41KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

16KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

8KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

202KB

Virtual Size

7.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

1916-172-0x0000000000CB0000-0x000000000189E000-memory.dmp

generic