Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15-09-2024 01:33

General

  • Target

    fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2.exe

  • Size

    4.1MB

  • MD5

    7fa5c660d124162c405984d14042506f

  • SHA1

    69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f

  • SHA256

    fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2

  • SHA512

    d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c

  • SSDEEP

    98304:if7X0ZueTTPs6deIF+iHtcbBt2VSFjUCaZ:8bPeVdeIMiHmbeVS

Malware Config

Extracted

Family

stealc

Botnet

default

C2

http://91.202.233.158

Attributes
  • url_path

    /e96ea2db21fa9a1b.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2.exe
    "C:\Users\Admin\AppData\Local\Temp\fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
      C:\Users\Admin\AppData\Local\Temp\svchost015.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\svchost015.exe

    Filesize

    2.9MB

    MD5

    b826dd92d78ea2526e465a34324ebeea

    SHA1

    bf8a0093acfd2eb93c102e1a5745fb080575372e

    SHA256

    7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

    SHA512

    1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

  • memory/2196-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2196-6-0x0000000003890000-0x0000000003BF9000-memory.dmp

    Filesize

    3.4MB

  • memory/2196-20-0x0000000000400000-0x000000000081B000-memory.dmp

    Filesize

    4.1MB

  • memory/2796-22-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

  • memory/2796-5-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

  • memory/2796-8-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

  • memory/2796-10-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

  • memory/2796-21-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

  • memory/2796-19-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

  • memory/2796-16-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

  • memory/2796-14-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

  • memory/2796-12-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

  • memory/2796-23-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB