Analysis
-
max time kernel
195s -
max time network
257s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
25-07-2024 22:45
General
-
Target
a04eed72375bdd8a6ce118e30e79cf6dc4618e4c748873c0da29cf0e9f9f031c.exe
-
Size
679KB
-
MD5
6ab4c3608fa8ddc687eab56f7eb527a8
-
SHA1
4e416fa39b139eaf9cdc29e2d7346541561aa11b
-
SHA256
a04eed72375bdd8a6ce118e30e79cf6dc4618e4c748873c0da29cf0e9f9f031c
-
SHA512
05b9ede5f71fbb5d1ccf319c804fa63965bb98c13273b51928e0295ec4746d879a3d6e7657a0bfe8f79a1503dd01400e23265092b81474462fcc47c094f591ed
-
SSDEEP
12288:+3XWClo7YNQSTLLxez8dFlZqBjEG6umSyY6+FD7cb48A2cDwZpC:+WCmwQLz+8ziY9Fsb48A2b
Score
10/10
Malware Config
Extracted
Family
stealc
Botnet
default
C2
http://85.28.47.31
Attributes
-
url_path
/5499d72b3a3e55be.php
Signatures
-
Stealc
Stealc is an infostealer written in C++.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a04eed72375bdd8a6ce118e30e79cf6dc4618e4c748873c0da29cf0e9f9f031c.exe"C:\Users\Admin\AppData\Local\Temp\a04eed72375bdd8a6ce118e30e79cf6dc4618e4c748873c0da29cf0e9f9f031c.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
-
Filesize
5.8MB