stealc | 5afd5d949b10aa25737aeaf454ae3ad441311a50d0e8aace71ebec8ffe7118cf

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 998KB
Sample241008-p2xl8a1fpf
SHA256 5afd5d949b10aa25737aeaf454ae3ad441311a50d0e8aace71ebec8ffe7118cf
MD5 888da0597b89d2a8dfc4c5d7dfb22dfd
SHA1 e9e2e864d4481edb3986bee9dc5c0ec1f7c75ffb
SHA512 2c74dccafa60be62479bde02ae76d591ad0399342ef46d3413fa63b6409bbcdc20031e8c97e9e92635587091300a2af7a9b9366f20ede78967d1090a10380db8
SSDEEP 24576:3iMy6W/0Pm3TL5HsTGdQw7qyxNif9wNknhIlVv22mtwbcPBjTP:SMLDyL5AZ429EkGl9maApTP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc discovery stealer

Malware Config

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 1 IoCs

pid	Process
2880	Lasting.pif

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
4400	tasklist.exe
3432	tasklist.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\FebruarySupplemental	file.exe
File opened for modification	C:\Windows\GuestAdventure	file.exe
File opened for modification	C:\Windows\TicketDistributed	file.exe
File opened for modification	C:\Windows\CommentedForbes	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lasting.pif

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2880	Lasting.pif
2880	Lasting.pif
2880	Lasting.pif
2880	Lasting.pif
2880	Lasting.pif
2880	Lasting.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4400	tasklist.exe
Token: SeDebugPrivilege	3432	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2880	Lasting.pif
2880	Lasting.pif
2880	Lasting.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2880	Lasting.pif
2880	Lasting.pif
2880	Lasting.pif

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 4512	5100	file.exe	85
PID 5100 wrote to memory of 4512	5100	file.exe	85
PID 5100 wrote to memory of 4512	5100	file.exe	85
PID 4512 wrote to memory of 4400	4512	cmd.exe	87
PID 4512 wrote to memory of 4400	4512	cmd.exe	87
PID 4512 wrote to memory of 4400	4512	cmd.exe	87
PID 4512 wrote to memory of 2960	4512	cmd.exe	88
PID 4512 wrote to memory of 2960	4512	cmd.exe	88
PID 4512 wrote to memory of 2960	4512	cmd.exe	88
PID 4512 wrote to memory of 3432	4512	cmd.exe	90
PID 4512 wrote to memory of 3432	4512	cmd.exe	90
PID 4512 wrote to memory of 3432	4512	cmd.exe	90
PID 4512 wrote to memory of 3652	4512	cmd.exe	91
PID 4512 wrote to memory of 3652	4512	cmd.exe	91
PID 4512 wrote to memory of 3652	4512	cmd.exe	91
PID 4512 wrote to memory of 4488	4512	cmd.exe	92
PID 4512 wrote to memory of 4488	4512	cmd.exe	92
PID 4512 wrote to memory of 4488	4512	cmd.exe	92
PID 4512 wrote to memory of 4156	4512	cmd.exe	93
PID 4512 wrote to memory of 4156	4512	cmd.exe	93
PID 4512 wrote to memory of 4156	4512	cmd.exe	93
PID 4512 wrote to memory of 3972	4512	cmd.exe	94
PID 4512 wrote to memory of 3972	4512	cmd.exe	94
PID 4512 wrote to memory of 3972	4512	cmd.exe	94
PID 4512 wrote to memory of 2880	4512	cmd.exe	95
PID 4512 wrote to memory of 2880	4512	cmd.exe	95
PID 4512 wrote to memory of 2880	4512	cmd.exe	95
PID 4512 wrote to memory of 4624	4512	cmd.exe	96
PID 4512 wrote to memory of 4624	4512	cmd.exe	96
PID 4512 wrote to memory of 4624	4512	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Pledge Pledge.bat & Pledge.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4400
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa opssvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2960
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3432
- - C:\Windows\SysWOW64\findstr.exe
    findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3652
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 84158
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4488
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "ModulesInfectionsAlexandriaFeature" Lamp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4156
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Incentive + ..\Slave + ..\Coming + ..\Workshop + ..\Moldova i
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3972
- - C:\Users\Admin\AppData\Local\Temp\84158\Lasting.pif
    Lasting.pif i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2880
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Lasting.pif

Path C:\Users\Admin\AppData\Local\Temp\84158\Lasting.pif
Size 872KB
SHA256 d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd
MD5 18ce19b57f43ce0a5af149c96aecc685
SHA1 1bd5ca29fc35fc8ac346f23b155337c5b28bbc36
SHA512 a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558
SSDEEP 12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\84158\i
Size 451KB
SHA256 9d894f9e805e7ee9c74388d7db5f9e1db27b4ad007a585e9e8fe759c2ace4ea2
MD5 3c0c04401968ab515f33989ee9d9e2d7
SHA1 f684cbae78b649c4b7e84223848b1b6d93098198
SHA512 d50aa7a2b10bdf892f5ba837184150ab5e8a14760cf8e68ec3c358acfd3aaab4925d221b6a365f774b3d205cd7d30c42673f763d90a6ccb9b138a4a77688bc3b
SSDEEP 12288:4hw0y2Idkup9z56ZdMOHE8sM8KRmihf7nx1c:4EdkuzV67VsZYVhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Coming

Path C:\Users\Admin\AppData\Local\Temp\Coming
Size 98KB
SHA256 03b54063e4c9fdf21c3a96d47c8656d362ea4a61ebfff32472fda18288f3f48d
MD5 15edcf792d0f0ca1cc7904d4ae62c923
SHA1 6045603a7383d84f2dfb918e3cf87c229ae20ebf
SHA512 f0e0eaba48f52e6edad1442e681a5eca25a2aabb73cda4836a6ed76236888d11bbf138fa00f6014879d670cf0c09e15f8eaac68538859d3715f0f33968449eba
SSDEEP 1536:AhRDujtHbj6LedM30dKmWR4/anObdA+dE86igbNN/zhxoT3guo7a0ZQ4h1r5:APDujYid6GnSOHE86VzLDoT09Nbr5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Incentive

Path C:\Users\Admin\AppData\Local\Temp\Incentive
Size 93KB
SHA256 5880c2ba93bf1e322b9b64dde80482fbf8241a774183065f0a66da77a24dc811
MD5 262a7cb0b04d21fec7dad22a56078105
SHA1 a42047d2bc9ec89301bf76833171fa06bc903ff4
SHA512 da9f2c2df9b289e6e3a387b69d88a3b663b2a2fa08ec64602f9d0d9b569c5502a7a60baf9c6a7ab249cdf1d7dafd8e219c422f131673f48b371da5cf71cc3465
SSDEEP 1536:Rr/BCKN5pidaBug/5ITTZC3HNw0c6xb5TiLjPxCjl2G9QHoqek8p/2yy/LLe7YcL:RrphNQav5C43HNn9b5Ti0UUeeOsoAxp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lamp

Path C:\Users\Admin\AppData\Local\Temp\Lamp
Size 6KB
SHA256 be87ed58e140de6d091be21ead68d21777477b1e2790534e4bac514c02abb8f1
MD5 9dd14448873dff335f125cbe9dc393ae
SHA1 19ea969e8ba42886a1e063eddd65d0b7a4805f4c
SHA512 b34fd8652433eb72a744509f6b862f17a1258c623e6b02f6ffcd96373fa1d4541fb0a40600bba2fb30873742486bb269b115cb156659f8cb163ee55851f627c0
SSDEEP 192:nHAeOqAFDw09CV/2nPvj6DdMP3r1HI5jm:nHAHhww+/2nlP3r1Wm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Moldova

Path C:\Users\Admin\AppData\Local\Temp\Moldova
Size 67KB
SHA256 55d7b462d55257cb875ea3c06eec139087ae46527e93083fb2b307a33ab9fbb5
MD5 8b3c8ef2b1a323129bbcd2676bc53128
SHA1 7aeea7c18854fe6b76989cfd069ca6027b95645a
SHA512 0ffe8e704b280f5524222a37880c9eb28725ae9a46b8203f69b297b7a797291bc7444fecf9d23399bb6c7a80ebbf9081d788258e0aac782573de99d25da0e42a
SSDEEP 1536:GtUg086Nd9pOeE9eINvG+3ih8v2rqyvW1DjE:G49E9eINvG+Sh8v2q1DQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pledge

Path C:\Users\Admin\AppData\Local\Temp\Pledge
Size 7KB
SHA256 cfb8b8ae98588472553f431cad72c7bfed2038307e212f682b31fb9d60bdac45
MD5 d6437d94b27b4eb87c9151b06bf21601
SHA1 de1743c13e8de2312e941924421e9818984d5632
SHA512 f4f032d80ccf33aff2866848690fba08ad26630ce797de16ab386a0154238f57c514c44c6eed3042d4ca2614293f0e9f766068daaf891a8449b6817befdb0b2a
SSDEEP 192:970+nHc+UPyPTvYirwO2l+mbJuNKqa5JokfIep:94+1UPYAif2l3bsNKqkfIs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Pr
Size 866KB
SHA256 420be9a63a7efea1a98052c744a16aa3f9af6af96ed40bbc29b7773d12ca16c1
MD5 56604e498dc7604384df38ca42860366
SHA1 16a3b078b05ac35b629bc5cd491d79ca777006a4
SHA512 a69ff6f4a9cf75bd62f17063b8888c3b32f4394d6208ee8901ed426d39a87e0bc99253b2f64c6bbbf18855309529c7cb42bf5b107c37c61b7ac0faa0968f881d
SSDEEP 12288:EV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:+xz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

Submit Download

Slave

Path C:\Users\Admin\AppData\Local\Temp\Slave
Size 99KB
SHA256 aee67a5dfd3cdfa602316c90fa746b21a5b6d8969e2236d8b1f5691af4c08e71
MD5 3f8d2748ccb68673d6d6cce431e3eccb
SHA1 dc1940e55213a9221ff3ad179d2cb1360205863e
SHA512 b286fec321d0981b9098275c8d9e7a099886f9889efa0707a00d973cffbda7ca08ff2008dcc5eb4a4d4a52a7d5ec2a857058c6339b690468dceb4c654b8602cb
SSDEEP 3072:uClaiT6fNIN18ChLxiCkung2vXA12/7ew+IcK2:uC4Py3pLECkug2N/7Pf2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Workshop

Path C:\Users\Admin\AppData\Local\Temp\Workshop
Size 94KB
SHA256 36e78a13f4cfc76f6e7823d77cc84d90dfa7ae5ba56aa06c67c8c284a086c760
MD5 4f6a9d3477f08a3260e22e72a9f56ad1
SHA1 c073c52df221c2b8e6536c9659a543883595d6d6
SHA512 54c9e8594a04fac25a430f025e8a2d29631a73582d77ec541b3c573252f13fc9db54c077e6e89cdaf38bb482c1a5186dd0bdb95cad9f60cac0eb6e1621abc174
SSDEEP 1536:NRe9ZnKihw7Ex/DIFTouqQEYo7LLqYrVZyoxFKlqEB7whjkvRy11NjLRXHUNzxOI:y9//DI+uqQ07rJMbB8eI70XO0Ka
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2880-24-0x0000000004640000-0x00000000048A1000-memory.dmp

Download

memory/2880-23-0x0000000004640000-0x00000000048A1000-memory.dmp

Download

memory/2880-25-0x0000000004640000-0x00000000048A1000-memory.dmp

Download

memory/2880-26-0x0000000004640000-0x00000000048A1000-memory.dmp

Download

memory/2880-27-0x0000000004640000-0x00000000048A1000-memory.dmp

Download