stealc | 3d07b09f83f2fc5dcb7f2429cac9a37160181da77df5a429e37b98dd685f239f

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 16:44

Target

swizzzz.exe
Size

352KB
MD5

a74811b7e2d71612463144c69c0ca7e2
SHA1

900132a2213f70aed06e9982e47cfdcc8964b710
SHA256

3d07b09f83f2fc5dcb7f2429cac9a37160181da77df5a429e37b98dd685f239f
SHA512

c4c5bef04693f000ae1f45d2a2d28f67609f36a635464d5025a50b939eaf9cc8d7766355990847f5679375f3d4b760e035dd92914f754ae64df6923da1cecebe
SSDEEP

6144:IsCv/QNuZNjDPp9XC2Fgd6dwiJLR8ATGb5gBJYgEltzK5d5Sw+tuhdZUui/EO:I/+uZNjDPNGeR85+YgEf25CtuhLi/EO

Score

10^/10

Family

stealc

Botnet

cuapfss

http://23.88.106.134

Attributes

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 748 set thread context of 4376	748	swizzzz.exe	86

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 4376	748	swizzzz.exe	86
PID 748 wrote to memory of 4376	748	swizzzz.exe	86
PID 748 wrote to memory of 4376	748	swizzzz.exe	86
PID 748 wrote to memory of 4376	748	swizzzz.exe	86
PID 748 wrote to memory of 4376	748	swizzzz.exe	86
PID 748 wrote to memory of 4376	748	swizzzz.exe	86
PID 748 wrote to memory of 4376	748	swizzzz.exe	86
PID 748 wrote to memory of 4376	748	swizzzz.exe	86
PID 748 wrote to memory of 4376	748	swizzzz.exe	86

C:\Users\Admin\AppData\Local\Temp\swizzzz.exe
"C:\Users\Admin\AppData\Local\Temp\swizzzz.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4376

memory/748-0-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/748-2-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/4376-1-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/4376-4-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/4376-5-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/4376-6-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download