stealc | 6f223a1b7ede367a5746bd7f92491b16760f87840924e81d812ac2a1c8e3b17c

Analysis

max time kernel
74s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d2ae38a13e9ac87e4c75441cf69280f0N.exe
Size

9.0MB
MD5

d2ae38a13e9ac87e4c75441cf69280f0
SHA1

b0fa6a65ddee7dba5a571b2b1e0653a9c4d8e1fc
SHA256

6f223a1b7ede367a5746bd7f92491b16760f87840924e81d812ac2a1c8e3b17c
SHA512

0d6f06e2785047c60ac1a7234f9f73c82ca75c94e846618fcab189273b5e957f372d17c926ec177f64fb4c2c2299d313ae54f415bc4f77fe0f7a5714364a7799
SSDEEP

196608:hi8k3/Fy8zBczPwl+lUXzcvLLGR8o+lrePyp8P+fCVsKoGjcxB8qWh7b7LVW9aCK:hPk39ewl+licv/+8rYyyP+BxB8qWh7/a

Score

10^/10

stealc 2634oijxwerrr discovery stealer

Malware Config

Extracted

Family

stealc

Botnet

2634oijxwerrr

http://45.149.172.56

Attributes

url_path
/8de6d2a30c50e042.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Executes dropped EXE 1 IoCs

pid	Process
1732	nSHgLA`Et

Loads dropped DLL 9 IoCs

pid	Process
1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe
1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1916 set thread context of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3160	1732	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2ae38a13e9ac87e4c75441cf69280f0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nSHgLA`Et

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31
PID 1916 wrote to memory of 1732	1916	d2ae38a13e9ac87e4c75441cf69280f0N.exe	31

C:\Users\Admin\AppData\Local\Temp\d2ae38a13e9ac87e4c75441cf69280f0N.exe
"C:\Users\Admin\AppData\Local\Temp\d2ae38a13e9ac87e4c75441cf69280f0N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\nSHgLA`Et
  "C:\Users\Admin\AppData\Local\Temp\nSHgLA`Et"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 44
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:3160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nSHgLA`Et

Filesize
38KB

MD5
3992f464696b0eeff236aef93b1fdbd5

SHA1
8dddabaea6b342efc4f5b244420a0af055ae691e

SHA256
0d1a8457014f2eb2563a91d1509dba38f6c418fedf5f241d8579d15a93e40e14

SHA512
27a63b43dc50faf4d9b06e10daa15e83dfb3f3be1bd3af83ea6990bd8ae6d3a6a7fc2f928822db972aaf1305970f4587d768d68cd7e1124bc8f710c1d3ee19a6

Download Submit
memory/1732-7-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1732-13-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1732-11-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1732-10-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1732-16-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1732-15-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download