stealc | b3613d68d751db139c727ee5b6ac08eaa8c16e65f101d2fc180bbd51f34f4f66

Analysis

max time kernel
240s
max time network
244s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 22:47

Target

b3613d68d751db139c727ee5b6ac08eaa8c16e65f101d2fc180bbd51f34f4f66.exe
Size

678KB
MD5

d4c082c4660a6c5d6c30fd469aedd932
SHA1

ebe0234906ae6c5771a638275c47874427db0765
SHA256

b3613d68d751db139c727ee5b6ac08eaa8c16e65f101d2fc180bbd51f34f4f66
SHA512

a9f59f8627f1c257c6247d3986e94d4791be91ccc7c791143056c095bf7c07f79bb7fd48d5cc700530b3228ef8b2e5f61e491977e1ea356b7a953467046b4f59
SSDEEP

12288:7WPsBl8o7YNQHN2K3yd9ids0JKpKyVjqdE4VT1VjRydmKceGOlX25HqvoRv:7WEbFwQHN2K3yWds0JkKyVjqC4VTzymt

Score

10^/10

Family

stealc

Botnet

default

http://85.28.47.31

Attributes

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b3613d68d751db139c727ee5b6ac08eaa8c16e65f101d2fc180bbd51f34f4f66.exe

pid process

2540 b3613d68d751db139c727ee5b6ac08eaa8c16e65f101d2fc180bbd51f34f4f66.exe

pid	process
2540	b3613d68d751db139c727ee5b6ac08eaa8c16e65f101d2fc180bbd51f34f4f66.exe

C:\Users\Admin\AppData\Local\Temp\b3613d68d751db139c727ee5b6ac08eaa8c16e65f101d2fc180bbd51f34f4f66.exe
"C:\Users\Admin\AppData\Local\Temp\b3613d68d751db139c727ee5b6ac08eaa8c16e65f101d2fc180bbd51f34f4f66.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2540

memory/2540-0-0x0000000001210000-0x00000000017E8000-memory.dmp

Filesize
5.8MB

Download
memory/2540-3-0x0000000001210000-0x00000000017E8000-memory.dmp

Filesize
5.8MB

Download