Analysis
-
max time kernel
195s -
max time network
298s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
25-07-2024 22:47
General
-
Target
b3613d68d751db139c727ee5b6ac08eaa8c16e65f101d2fc180bbd51f34f4f66.exe
-
Size
678KB
-
MD5
d4c082c4660a6c5d6c30fd469aedd932
-
SHA1
ebe0234906ae6c5771a638275c47874427db0765
-
SHA256
b3613d68d751db139c727ee5b6ac08eaa8c16e65f101d2fc180bbd51f34f4f66
-
SHA512
a9f59f8627f1c257c6247d3986e94d4791be91ccc7c791143056c095bf7c07f79bb7fd48d5cc700530b3228ef8b2e5f61e491977e1ea356b7a953467046b4f59
-
SSDEEP
12288:7WPsBl8o7YNQHN2K3yd9ids0JKpKyVjqdE4VT1VjRydmKceGOlX25HqvoRv:7WEbFwQHN2K3yWds0JkKyVjqC4VTzymt
Score
10/10
Malware Config
Extracted
Family
stealc
Botnet
default
C2
http://85.28.47.31
Attributes
-
url_path
/5499d72b3a3e55be.php
Signatures
-
Stealc
Stealc is an infostealer written in C++.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3613d68d751db139c727ee5b6ac08eaa8c16e65f101d2fc180bbd51f34f4f66.exe"C:\Users\Admin\AppData\Local\Temp\b3613d68d751db139c727ee5b6ac08eaa8c16e65f101d2fc180bbd51f34f4f66.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
-
Filesize
5.8MB