stealc | f0c3e45b96e2fa1bcd7f39a9a80337314cc27ea3df30a90c594b43fa8487adc6

Analysis

max time kernel
195s
max time network
258s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
11/07/2024, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0c3e45b96e2fa1bcd7f39a9a80337314cc27ea3df30a90c594b43fa8487adc6.exe
Size

8.4MB
MD5

74758f61067ea9fa0e2a4593920ed0f2
SHA1

bc2787dd0758f109c4ba06bf1c65d50180de928d
SHA256

f0c3e45b96e2fa1bcd7f39a9a80337314cc27ea3df30a90c594b43fa8487adc6
SHA512

70f906346d110b3db97f3210dcf9ec6f534fa9b39fc7bf0ae16c27f3c8e6064acfdff03f14366ce7a40eb5d28e8038a42b836bc338a7fbd4a6188b6198e8a7c7
SSDEEP

98304:o/y61b9wu3zcEWzjWFcgO/B8Px3DwGVMbalzWaPCE3s61u3:qRwgzc0TucxDwGjXPP3C

Score

10^/10

stealc hello stealer

Malware Config

Extracted

Family

stealc

Botnet

hello

http://91.92.240.120

Attributes

url_path
/e2d7d29621e1052a.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4236 set thread context of 4944	4236	f0c3e45b96e2fa1bcd7f39a9a80337314cc27ea3df30a90c594b43fa8487adc6.exe	72

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BitLockerToGo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	BitLockerToGo.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4944	BitLockerToGo.exe
4944	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 4944	4236	f0c3e45b96e2fa1bcd7f39a9a80337314cc27ea3df30a90c594b43fa8487adc6.exe	72
PID 4236 wrote to memory of 4944	4236	f0c3e45b96e2fa1bcd7f39a9a80337314cc27ea3df30a90c594b43fa8487adc6.exe	72
PID 4236 wrote to memory of 4944	4236	f0c3e45b96e2fa1bcd7f39a9a80337314cc27ea3df30a90c594b43fa8487adc6.exe	72
PID 4236 wrote to memory of 4944	4236	f0c3e45b96e2fa1bcd7f39a9a80337314cc27ea3df30a90c594b43fa8487adc6.exe	72
PID 4236 wrote to memory of 4944	4236	f0c3e45b96e2fa1bcd7f39a9a80337314cc27ea3df30a90c594b43fa8487adc6.exe	72

C:\Users\Admin\AppData\Local\Temp\f0c3e45b96e2fa1bcd7f39a9a80337314cc27ea3df30a90c594b43fa8487adc6.exe
"C:\Users\Admin\AppData\Local\Temp\f0c3e45b96e2fa1bcd7f39a9a80337314cc27ea3df30a90c594b43fa8487adc6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4236-9-0x00007FF603840000-0x00007FF604112000-memory.dmp

Filesize
8.8MB

Download
memory/4944-4-0x0000000003000000-0x000000000323C000-memory.dmp

Filesize
2.2MB

Download
memory/4944-10-0x0000000003000000-0x000000000323C000-memory.dmp

Filesize
2.2MB

Download
memory/4944-8-0x0000000003000000-0x000000000323C000-memory.dmp

Filesize
2.2MB

Download
memory/4944-12-0x0000000003000000-0x000000000323C000-memory.dmp

Filesize
2.2MB

Download
memory/4944-13-0x0000000003000000-0x000000000323C000-memory.dmp

Filesize
2.2MB

Download