Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
05-08-2024 09:28
General
-
Target
2810edd1f6141162f03cbcf14677108ec4449cb8c15637a83a51ab9b36e75551.exe
-
Size
2.5MB
-
MD5
83d776646e204bbdc4e65b2251a17f26
-
SHA1
2d46f42fe5e17f36b4c1a7409c691b0bfb86bd0e
-
SHA256
2810edd1f6141162f03cbcf14677108ec4449cb8c15637a83a51ab9b36e75551
-
SHA512
8c6a10202dd3234b607cd1da4e563b6fc498cfe50f1b8312816a6e04478d6a9c88596813b634fb4cae1f889fcd357fce316decc5d871b6b89db2e3f011aea2f0
-
SSDEEP
49152:exeOAwBApSJdHFtSEXniknCRLmPtwWd/qb9m2TcAC0Xntb:exvAwyp0HFtSEXnfCEPuWdSb9TcrEV
Score
10/10
Malware Config
Extracted
Family
stealc
Botnet
default
C2
http://185.215.113.24
Attributes
-
url_path
/e2b1563c6670f193.php
Signatures
-
Stealc
Stealc is an infostealer written in C++.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2810edd1f6141162f03cbcf14677108ec4449cb8c15637a83a51ab9b36e75551.exe"C:\Users\Admin\AppData\Local\Temp\2810edd1f6141162f03cbcf14677108ec4449cb8c15637a83a51ab9b36e75551.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.0MB
-
Filesize
3.8MB
-
Filesize
2.0MB
-
Filesize
192KB
-
Filesize
2.3MB
-
Filesize
12.0MB
-
Filesize
2.3MB
-
Filesize
3.8MB