stealc | 59f20114929a66a4c6243ae9d416192f0b7a584c6d3a07253e0cc69776b4de46

Analysis

max time kernel
151s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
07/07/2024, 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

663.4MB
MD5

70a9e51d9777a02427404e4dc2325f0f
SHA1

b340348b78dcbbdc49dc9206f68aa3950723b964
SHA256

f9f5fe8a6d4ef35fdacc5623b1dc689be3ea89c61efdf68e0ddf449916396f05
SHA512

65888e9a446880cd8911ed56047392c00735fe484530962e8d1b70256b082c9eff822b4db0c84db689e5f11331b56acfa62d86b0a496f8b6b744380853b86ebe
SSDEEP

196608:Xpcugy7TlXNdj+P64+SPrW7hOOo4j704ehNVhV98x+L5rCZhwNNwL84XiOHWgE:Xpcu7k6BkOxU4o

Score

10^/10

stealc puaro spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

Puaro

https://9507c272a51ce8cefc8761591b2c50e6.fit

Attributes

url_path
/2fca4d4264af2833.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1488	AKFCBFHJDH.exe

Loads dropped DLL 2 IoCs

pid	Process
4056	SearchIndexer.exe
4056	SearchIndexer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4800 set thread context of 3148	4800	Setup.exe	72
PID 1488 set thread context of 4256	1488	AKFCBFHJDH.exe	78

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\L-Connect Service.job	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SearchIndexer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4800	Setup.exe
4800	Setup.exe
3148	comp.exe
3148	comp.exe
4056	SearchIndexer.exe
4056	SearchIndexer.exe
4056	SearchIndexer.exe
4056	SearchIndexer.exe
1488	AKFCBFHJDH.exe
1488	AKFCBFHJDH.exe
4256	cmd.exe
4256	cmd.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4800	Setup.exe
3148	comp.exe
1488	AKFCBFHJDH.exe
4256	cmd.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3148	4800	Setup.exe	72
PID 4800 wrote to memory of 3148	4800	Setup.exe	72
PID 4800 wrote to memory of 3148	4800	Setup.exe	72
PID 4800 wrote to memory of 3148	4800	Setup.exe	72
PID 3148 wrote to memory of 4056	3148	comp.exe	74
PID 3148 wrote to memory of 4056	3148	comp.exe	74
PID 3148 wrote to memory of 4056	3148	comp.exe	74
PID 3148 wrote to memory of 4056	3148	comp.exe	74
PID 3148 wrote to memory of 4056	3148	comp.exe	74
PID 4056 wrote to memory of 3756	4056	SearchIndexer.exe	75
PID 4056 wrote to memory of 3756	4056	SearchIndexer.exe	75
PID 4056 wrote to memory of 3756	4056	SearchIndexer.exe	75
PID 3756 wrote to memory of 1488	3756	cmd.exe	77
PID 3756 wrote to memory of 1488	3756	cmd.exe	77
PID 3756 wrote to memory of 1488	3756	cmd.exe	77
PID 1488 wrote to memory of 4256	1488	AKFCBFHJDH.exe	78
PID 1488 wrote to memory of 4256	1488	AKFCBFHJDH.exe	78
PID 1488 wrote to memory of 4256	1488	AKFCBFHJDH.exe	78
PID 1488 wrote to memory of 4256	1488	AKFCBFHJDH.exe	78
PID 4256 wrote to memory of 2556	4256	cmd.exe	81
PID 4256 wrote to memory of 2556	4256	cmd.exe	81
PID 4256 wrote to memory of 2556	4256	cmd.exe	81
PID 4256 wrote to memory of 2556	4256	cmd.exe	81
PID 4256 wrote to memory of 2556	4256	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\comp.exe
  C:\Windows\SysWOW64\comp.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\SysWOW64\SearchIndexer.exe
    C:\Windows\SysWOW64\SearchIndexer.exe
    3⤵
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4056
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AKFCBFHJDH.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\AKFCBFHJDH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AKFCBFHJDH.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1488
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        6⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        7⤵
        
        PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\ProgramData\Files.docx

Filesize
11KB

MD5
4a8fbd593a733fc669169d614021185b

SHA1
166e66575715d4c52bcb471c09bdbc5a9bb2f615

SHA256
714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

SHA512
6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

Download Submit
C:\Users\Admin\AppData\Local\Temp\AKFCBFHJDH.exe

Filesize
4.2MB

MD5
01b77cf729fa55834d4ea8be3602255f

SHA1
2371f13477843b45b3f12d058432b283ce264733

SHA256
76bb3021ce006df3ecf9740b1eb164bd1036472ae68fe262767d0025b94ecede

SHA512
5d85ef4e23d1de2e4b3a2a622e7062bc0356b1c7a89be8979d239fc3d04814434d992cac5788299a5e3b25ae9e0d41ca5662d9897d39524da75782d3380962d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\e6f83d3c

Filesize
876KB

MD5
97a3924f38b6fe507dbcce5621dddd82

SHA1
ae07c5939a1135b359f9816651b0372f5d774df4

SHA256
366b99bf15bff92a31b7c2fdd8d2f27bab9c08eb1cd6f7c2dd6923b63912179c

SHA512
3c3e479fca7f16b984e72c4ad97fe6f541c386048f07bb88b43dda06e037eb98b7376a7fd3682d3522f396e27e6135488f2156f669448128edc2f8ec9075d270

Download Submit
C:\Users\Admin\AppData\Local\Temp\e84e9bf2

Filesize
869KB

MD5
66ffe63d6de0a98584ad361928efc567

SHA1
ba7b13fe31e11ea5af8b311720773b828107183f

SHA256
0ecc86989040b95f7ef33ea706643f56cd76c70271729d7ff8cedfb3f12fd771

SHA512
a4486521327752d8d2b008ffee613052bee6624a57a2c0d2d3f36c798cdce3f07f2b162270ba4944e64faef16a71399418aad5213dd38bf74d1ce76ed4937b01

Download Submit
C:\Users\Admin\AppData\Local\Temp\f176f6a9

Filesize
1.1MB

MD5
82e99a942be9e87d87605f37c5d844d2

SHA1
b3b99274d676558c3c4f5b6b45e3f871a908b07e

SHA256
3386e4e5d2af739636f374f2f2a18d07f5a3c33eab9eacd664b6ae5a8096e468

SHA512
9eeab9a65bae7145868b2d28be8538f7eba57b4167add8c4568a855d9c26d09667ea1436a74d300f146cbd4cd096539e29c98be121da4a4f72907561b2b32e29

Download Submit
C:\Users\Admin\AppData\Local\Temp\f3a2b836

Filesize
1.1MB

MD5
797d9c7e901fd2d7d81548e94a4b3389

SHA1
0505a7511be3735fdcdea3095b17a85a93e80066

SHA256
aeb8d8e350ca7bceaa5aff67201636c0c65369f1e87b56c18beb0c4e2f3bdeb3

SHA512
788f18b06eaba9576feb41e93dd4667a4550834396479cd89319b058a2bc3602f30a6fcf2764ec8a767c648a1334cf7576869d022e7f9d9de982e58a786b741d

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
memory/1488-144-0x00007FF91A790000-0x00007FF91A96B000-memory.dmp

Filesize
1.9MB

Download
memory/1488-137-0x0000000001070000-0x00000000014AC000-memory.dmp

Filesize
4.2MB

Download
memory/1488-146-0x0000000073320000-0x00000000733B5000-memory.dmp

Filesize
596KB

Download
memory/1488-145-0x0000000073320000-0x00000000733B5000-memory.dmp

Filesize
596KB

Download
memory/1488-143-0x0000000073320000-0x00000000733B5000-memory.dmp

Filesize
596KB

Download
memory/2556-164-0x0000000000AF0000-0x0000000000B58000-memory.dmp

Filesize
416KB

Download
memory/2556-163-0x00007FF91A790000-0x00007FF91A96B000-memory.dmp

Filesize
1.9MB

Download
memory/3148-19-0x0000000072600000-0x0000000072695000-memory.dmp

Filesize
596KB

Download
memory/3148-21-0x0000000072600000-0x0000000072695000-memory.dmp

Filesize
596KB

Download
memory/3148-18-0x0000000072600000-0x0000000072695000-memory.dmp

Filesize
596KB

Download
memory/3148-17-0x00007FF91A790000-0x00007FF91A96B000-memory.dmp

Filesize
1.9MB

Download
memory/3148-15-0x0000000072600000-0x0000000072695000-memory.dmp

Filesize
596KB

Download
memory/4056-35-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4056-91-0x0000000000830000-0x0000000000A6D000-memory.dmp

Filesize
2.2MB

Download
memory/4056-22-0x0000000000830000-0x0000000000A6D000-memory.dmp

Filesize
2.2MB

Download
memory/4056-23-0x00007FF91A790000-0x00007FF91A96B000-memory.dmp

Filesize
1.9MB

Download
memory/4056-133-0x0000000000830000-0x0000000000A6D000-memory.dmp

Filesize
2.2MB

Download
memory/4056-24-0x0000000000830000-0x0000000000A6D000-memory.dmp

Filesize
2.2MB

Download
memory/4256-150-0x00007FF91A790000-0x00007FF91A96B000-memory.dmp

Filesize
1.9MB

Download
memory/4256-151-0x0000000073320000-0x00000000733B5000-memory.dmp

Filesize
596KB

Download
memory/4256-158-0x0000000073320000-0x00000000733B5000-memory.dmp

Filesize
596KB

Download
memory/4800-2-0x0000000000B00000-0x0000000001779000-memory.dmp

Filesize
12.5MB

Download
memory/4800-12-0x0000000072600000-0x0000000072695000-memory.dmp

Filesize
596KB

Download
memory/4800-8-0x0000000072600000-0x0000000072695000-memory.dmp

Filesize
596KB

Download
memory/4800-9-0x00007FF91A790000-0x00007FF91A96B000-memory.dmp

Filesize
1.9MB

Download
memory/4800-11-0x0000000072600000-0x0000000072695000-memory.dmp

Filesize
596KB

Download
memory/4800-10-0x0000000072612000-0x0000000072614000-memory.dmp

Filesize
8KB

Download