Analysis

  • max time kernel
    195s
  • max time network
    301s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    16-09-2024 05:06

General

  • Target

    fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2.exe

  • Size

    4.1MB

  • MD5

    7fa5c660d124162c405984d14042506f

  • SHA1

    69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f

  • SHA256

    fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2

  • SHA512

    d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c

  • SSDEEP

    98304:if7X0ZueTTPs6deIF+iHtcbBt2VSFjUCaZ:8bPeVdeIMiHmbeVS

Malware Config

Extracted

Family

stealc

Botnet

default

C2

http://91.202.233.158

Attributes
  • url_path

    /e96ea2db21fa9a1b.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2.exe
    "C:\Users\Admin\AppData\Local\Temp\fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1020
    • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
      C:\Users\Admin\AppData\Local\Temp\svchost015.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\svchost015.exe

    Filesize

    2.9MB

    MD5

    b826dd92d78ea2526e465a34324ebeea

    SHA1

    bf8a0093acfd2eb93c102e1a5745fb080575372e

    SHA256

    7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

    SHA512

    1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

  • memory/1020-0-0x0000000000970000-0x0000000000971000-memory.dmp

    Filesize

    4KB

  • memory/1020-1-0x0000000002E70000-0x00000000031D9000-memory.dmp

    Filesize

    3.4MB

  • memory/1020-10-0x0000000000400000-0x000000000081B000-memory.dmp

    Filesize

    4.1MB

  • memory/2664-4-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

  • memory/2664-9-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

  • memory/2664-11-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

  • memory/2664-8-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

  • memory/2664-12-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB