Analysis
-
max time kernel
117s -
max time network
137s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
10-08-2024 17:49
General
-
Target
1e6ad08c5ed9b4fdbef86181e8cd01170fe9ec5615d9a37f90e7ea43bcad175f.exe
-
Size
14.8MB
-
MD5
fcab15617dadd8fc0434901b33c0193f
-
SHA1
0689fff2810c13f8e3786fc1965792c92410693b
-
SHA256
1e6ad08c5ed9b4fdbef86181e8cd01170fe9ec5615d9a37f90e7ea43bcad175f
-
SHA512
62f202254baa9dfba73fb3e9ee7038307aee2f44c2060545b905310a65e4bdfb5cf1114f820ecfd9d477046e133c79d2ad77c710bf3d6314ccbc7b0f01c1c7dd
-
SSDEEP
98304:kL/xvZwtkt4DDQZqMEKYihlLSE7Qe9RVnxFsy4wN:k0mZZqMEPihlL/0eBN
Score
10/10
Malware Config
Extracted
Family
stealc
Botnet
cr1
C2
http://45.152.114.50
Attributes
-
url_path
/587ec30955d49a9c.php
Signatures
-
Stealc
Stealc is an infostealer written in C++.
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e6ad08c5ed9b4fdbef86181e8cd01170fe9ec5615d9a37f90e7ea43bcad175f.exe"C:\Users\Admin\AppData\Local\Temp\1e6ad08c5ed9b4fdbef86181e8cd01170fe9ec5615d9a37f90e7ea43bcad175f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15.2MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB