Overview

overview

10

Static

static

3

SecuriteIn...89.exe

windows7-x64

10

SecuriteIn...89.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/09/2024, 20:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Win32.BotX-gen.15571.29489.exe
  • Size 359KB
  • Sample240924-y6pa3stdln
  • SHA256 ae3ae0f5f9d8e2911a2e7feecf26e9567ca3f4fe8a9b6c9d7f350c2db6e6e1eb
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
stealcdefault3_capdiscoverystealer

Malware Config

Extracted

Family

  • stealc

Botnet

  • default3_cap

C2

  • http://62.204.41.159

Attributes
  • url_path

    /edd20096ecef326d.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Program crash 7 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.BotX-gen.15571.29489.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.BotX-gen.15571.29489.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2280
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 824
      2⤵
      • Program crash
      PID:4816
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 816
      2⤵
      • Program crash
      PID:2724
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 824
      2⤵
      • Program crash
      PID:2204
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 888
      2⤵
      • Program crash
      PID:1452
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 968
      2⤵
      • Program crash
      PID:2376
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 1092
      2⤵
      • Program crash
      PID:3372
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 1196
      2⤵
      • Program crash
      PID:4928
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2280 -ip 2280
    1⤵
      PID:116
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2280 -ip 2280
      1⤵
        PID:3472
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2280 -ip 2280
        1⤵
          PID:4976
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2280 -ip 2280
          1⤵
            PID:1688
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2280 -ip 2280
            1⤵
              PID:4900
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2280 -ip 2280
              1⤵
                PID:4216
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2280 -ip 2280
                1⤵
                  PID:1692

                Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      memory/2280-1-0x0000000000990000-0x0000000000A90000-memory.dmp
                      Download

                      memory/2280-2-0x0000000000910000-0x000000000095E000-memory.dmp
                      Download

                      memory/2280-3-0x0000000000400000-0x0000000000661000-memory.dmp
                      Download

                      memory/2280-5-0x0000000000910000-0x000000000095E000-memory.dmp
                      Download

                      memory/2280-4-0x0000000000400000-0x0000000000661000-memory.dmp
                      Download