Behavioral task
behavioral1
Sample
7a0716caf7b0d8236561dc71a529c71113a3b8345574d2c9f663c95da08fc43aN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7a0716caf7b0d8236561dc71a529c71113a3b8345574d2c9f663c95da08fc43aN.exe
Resource
win10v2004-20240802-en
General
-
Target
7a0716caf7b0d8236561dc71a529c71113a3b8345574d2c9f663c95da08fc43aN
-
Size
2.4MB
-
MD5
f90c52db6e76bbf49b3548752a42fbc0
-
SHA1
c11797420520129905162460d30795a70da8bde4
-
SHA256
7a0716caf7b0d8236561dc71a529c71113a3b8345574d2c9f663c95da08fc43a
-
SHA512
758419b24f9e17fa64090b7ea036fc2db89e959d1801a1cc4a3323d364fb925da1a9ed89e3bf5d1e84ea02758445820a46bd2f3c0ef0d3065c1a51a39c8aded7
-
SSDEEP
6144:FDi8xYtUokCulxMfpbK+engkcrFscU77+Uw3N/RQv8Yt9:CtUoH3Q+ocFhI7x8/Ret9
Malware Config
Extracted
stealc
default
http://46.8.231.109
-
url_path
/c4754d4f680ead72.php
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7a0716caf7b0d8236561dc71a529c71113a3b8345574d2c9f663c95da08fc43aN
Files
-
7a0716caf7b0d8236561dc71a529c71113a3b8345574d2c9f663c95da08fc43aN.exe windows:5 windows x86 arch:x86
8e9e6de8c6aa184371108e1074479bb3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
strncpy
??_V@YAXPAX@Z
memchr
??_U@YAPAXI@Z
strtok
atexit
strtok_s
strcpy_s
vsprintf_s
memmove
strlen
malloc
free
memcmp
??2@YAPAXI@Z
memset
memcpy
__CxxFrameHandler3
kernel32
GetCurrentProcess
RaiseException
GetStringTypeW
MultiByteToWideChar
LCMapStringW
IsValidCodePage
GetOEMCP
lstrlenA
HeapAlloc
GetProcessHeap
VirtualProtect
WaitForSingleObject
CreateProcessA
lstrcatA
VirtualQueryEx
OpenProcess
ReadProcessMemory
WriteFile
GetACP
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TerminateProcess
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
GetProcAddress
GetModuleHandleW
ExitProcess
Sleep
GetStdHandle
GetModuleFileNameW
GetLastError
LoadLibraryW
TlsGetValue
TlsSetValue
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WideCharToMultiByte
Sections
.text Size: 115KB - Virtual size: 115KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ