Behavioral task
behavioral1
Sample
3c2245fb7f3d374d8685a573a6cafbe79b5807f0f8cbd52f0cf4a203b785ab06.exe
Resource
win7-20240708-en
General
-
Target
3c2245fb7f3d374d8685a573a6cafbe79b5807f0f8cbd52f0cf4a203b785ab06
-
Size
187KB
-
MD5
ca10bc5dbf009b6df405c2ccbdd22efb
-
SHA1
d1c8f25dac637ba857ec28a0ffcfafa73e23a622
-
SHA256
3c2245fb7f3d374d8685a573a6cafbe79b5807f0f8cbd52f0cf4a203b785ab06
-
SHA512
61d6eba16eb34dcb230c15d11aad0c8ce8c64b79a886c6acfbf58dac777f32521d2d9ffb9d645a6cc763bfc0aa9bba403c469ba24eb814e3a009d0ab7f30daf8
-
SSDEEP
3072:c1VB1NFj5qD6o8KaxfE54HnnGiayl+beX8na5acUsRFrJKa:c171jj5q62aOanGiqbIzUGFdKa
Malware Config
Extracted
stealc
sila
http://85.28.47.31
-
url_path
/5499d72b3a3e55be.php
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c2245fb7f3d374d8685a573a6cafbe79b5807f0f8cbd52f0cf4a203b785ab06
Files
-
3c2245fb7f3d374d8685a573a6cafbe79b5807f0f8cbd52f0cf4a203b785ab06.exe windows:5 windows x86 arch:x86
75f38a281962eafd8c14d2b02cfcdab6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
strncpy
??_V@YAXPAX@Z
memchr
??_U@YAPAXI@Z
strtok
strtok_s
strcpy_s
vsprintf_s
memmove
strlen
malloc
free
memcmp
??2@YAPAXI@Z
memset
memcpy
__CxxFrameHandler3
kernel32
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
RaiseException
GetStringTypeW
MultiByteToWideChar
LCMapStringW
IsValidCodePage
lstrlenA
HeapAlloc
GetProcessHeap
VirtualProtect
VirtualQueryEx
OpenProcess
ReadProcessMemory
WriteFile
GetOEMCP
GetACP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
GetProcAddress
GetModuleHandleW
ExitProcess
Sleep
GetStdHandle
GetModuleFileNameW
GetLastError
LoadLibraryW
TlsGetValue
TlsSetValue
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCPInfo
Sections
.text Size: 114KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ