stealc | ac28e1fec7459e3a7a5e521710e9f09bc0b5f18c31fae3a981b6cfb6a85a7c34

Analysis

max time kernel
92s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3104-72-0x0000000000810000-0x0000000000A53000-memory.exe
Size

2.3MB
MD5

db92e7478dc4a146743828f3881ba26b
SHA1

4190e6cbe3049214da6455e2ef34de3dd4757fb2
SHA256

ac28e1fec7459e3a7a5e521710e9f09bc0b5f18c31fae3a981b6cfb6a85a7c34
SHA512

177c81f8387e44369dd931a15e1c64820b523298f18fbf6b800512d0cea033879411cac01baaf878fa84262fa52700129502836bc6235ae352ec048a5f6e423f
SSDEEP

3072:zxQiBVOOzSjpoUn4m4nG8262rajqMU/AkD4LFMEba:zxQkO68pxpUG8f2ujqMYR4LFzba

Score

10^/10

stealc discovery stealer

Malware Config

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	1612	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3104-72-0x0000000000810000-0x0000000000A53000-memory.exe

C:\Users\Admin\AppData\Local\Temp\3104-72-0x0000000000810000-0x0000000000A53000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3104-72-0x0000000000810000-0x0000000000A53000-memory.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 220
  2⤵
  - Program crash
  PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1612 -ip 1612
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-0-0x0000000000810000-0x0000000000A53000-memory.dmp

Filesize
2.3MB

Download