stealc | b2d61c7118d15aa3a5f155fc489b030210d2894658e83c96dfbe40b4a5cc0a75

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2024 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

209KB
MD5

a8b59ce897113d2648868890815459d7
SHA1

6f5ca8870d038cc28f5258aa7a558152f3862cda
SHA256

b2d61c7118d15aa3a5f155fc489b030210d2894658e83c96dfbe40b4a5cc0a75
SHA512

8f6d679e5790f17a2c93771b6a72e04d6bc2b3c494916883bb4ed55c9fac04bd72bbad66f740fb0f8ead365a4ecd7251793989aec24ef721422664033d7f8c1e
SSDEEP

3072:xLvfMRs6OwtkddFttI1L8wdLwHoKDMgVQ488XjJ17705n7:xLvURs6O4iHttI14wdIoJE58x

Score

10^/10

stealc sila discovery stealer

Malware Config

Extracted

Family

stealc

Botnet

sila

http://85.28.47.31

Attributes

url_path
/5499d72b3a3e55be.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4864	3492	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 1288
  2⤵
  - Program crash
  PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3492 -ip 3492
1⤵
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3492-2-0x00000000007B0000-0x00000000007E0000-memory.dmp

Filesize
192KB

Download
memory/3492-1-0x0000000000880000-0x0000000000980000-memory.dmp

Filesize
1024KB

Download
memory/3492-3-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/3492-4-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/3492-5-0x00000000007B0000-0x00000000007E0000-memory.dmp

Filesize
192KB

Download