Analysis
-
max time kernel
139s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
27/07/2024, 17:08
General
-
Target
15e918d1df17402cac720b75c85e81587d15ef620e89b639ad71085ce77ca8c8.exe
-
Size
1.1MB
-
MD5
77dfe19b8675d6b07dddaabb0b9d6ffe
-
SHA1
34c16e4540dfcca9f84497a8d8914b830f7d3c27
-
SHA256
15e918d1df17402cac720b75c85e81587d15ef620e89b639ad71085ce77ca8c8
-
SHA512
7825cb4dd3d9cd853b165afab9315e035eb12f554f619d6d3ffc82e36f96c6d043ba077ced35eeb14283447c94f507ea1c3de85f0d574d9a91ad500c859d4b82
-
SSDEEP
24576:x6Dzd05DeCQYG/uv2m7bg4fBOqItgze9Q+gs95159Ruv0P9/eUu:x2z6U4G/up/VfE3C+hAv0F
Score
10/10
Malware Config
Extracted
Family
stealc
Botnet
sila
C2
http://85.28.47.31
Attributes
-
url_path
/5499d72b3a3e55be.php
Signatures
-
Stealc
Stealc is an infostealer written in C++.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\15e918d1df17402cac720b75c85e81587d15ef620e89b639ad71085ce77ca8c8.exe"C:\Users\Admin\AppData\Local\Temp\15e918d1df17402cac720b75c85e81587d15ef620e89b639ad71085ce77ca8c8.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
-
Filesize
5.6MB