stealc | b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2

General

Target

6706ad721d914_JuidePorison.exe
Size

8.6MB
MD5

54e6bcf9be550a5b8e5cd7b83318942d
SHA1

0c9084c04d5dd833867a60376c0809e8276fd869
SHA256

b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2
SHA512

afed87e898d00a146c42f4c81b86fe5c243c205fabb3296d757915bc427bfa8fe91d7cad48a4d36f427168b90011d8ce05e8b3003ccf47f0a3e3ab5151eefd1f
SSDEEP

196608:CkQm7e7eIqv9n2vYLIRQ6SSQCpX67SfUDTsmpfCcXe+8BvSk:CkQm7e7eIqvF2vRCApXVwTsmpfCcL8g

Score

10^/10

stealc default7_doz discovery spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

default7_doz

C2

http://62.204.41.176

Attributes

url_path
/edd20096ecef326d.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
3492	CLTlurMmtAKyVe7xebyeD5Ww.exe
716	Ssjrth0UntGAF6S3jvQyYG0T.exe
440	CLTlurMmtAKyVe7xebyeD5Ww.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral3/files/0x0007000000023c80-27.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3492 set thread context of 440	3492	CLTlurMmtAKyVe7xebyeD5Ww.exe	92

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3940	3492	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6706ad721d914_JuidePorison.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CLTlurMmtAKyVe7xebyeD5Ww.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CLTlurMmtAKyVe7xebyeD5Ww.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1436	6706ad721d914_JuidePorison.exe
1436	6706ad721d914_JuidePorison.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 3492	1436	6706ad721d914_JuidePorison.exe	87
PID 1436 wrote to memory of 3492	1436	6706ad721d914_JuidePorison.exe	87
PID 1436 wrote to memory of 3492	1436	6706ad721d914_JuidePorison.exe	87
PID 3492 wrote to memory of 440	3492	CLTlurMmtAKyVe7xebyeD5Ww.exe	92
PID 3492 wrote to memory of 440	3492	CLTlurMmtAKyVe7xebyeD5Ww.exe	92
PID 3492 wrote to memory of 440	3492	CLTlurMmtAKyVe7xebyeD5Ww.exe	92
PID 3492 wrote to memory of 440	3492	CLTlurMmtAKyVe7xebyeD5Ww.exe	92
PID 3492 wrote to memory of 440	3492	CLTlurMmtAKyVe7xebyeD5Ww.exe	92
PID 3492 wrote to memory of 440	3492	CLTlurMmtAKyVe7xebyeD5Ww.exe	92
PID 3492 wrote to memory of 440	3492	CLTlurMmtAKyVe7xebyeD5Ww.exe	92
PID 3492 wrote to memory of 440	3492	CLTlurMmtAKyVe7xebyeD5Ww.exe	92
PID 3492 wrote to memory of 440	3492	CLTlurMmtAKyVe7xebyeD5Ww.exe	92

C:\Users\Admin\AppData\Local\Temp\6706ad721d914_JuidePorison.exe
"C:\Users\Admin\AppData\Local\Temp\6706ad721d914_JuidePorison.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Users\Admin\AppData\Local\Temp\DV9VHTlHfccssYND2qAm\CLTlurMmtAKyVe7xebyeD5Ww.exe
  C:\Users\Admin\AppData\Local\Temp\DV9VHTlHfccssYND2qAm\CLTlurMmtAKyVe7xebyeD5Ww.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Users\Admin\AppData\Local\Temp\DV9VHTlHfccssYND2qAm\CLTlurMmtAKyVe7xebyeD5Ww.exe
    "C:\Users\Admin\AppData\Local\Temp\DV9VHTlHfccssYND2qAm\CLTlurMmtAKyVe7xebyeD5Ww.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 236
    3⤵
    - Program crash
    PID:3940
- C:\Users\Admin\AppData\Local\Temp\DV9VHTlHfccssYND2qAm\Ssjrth0UntGAF6S3jvQyYG0T.exe
  C:\Users\Admin\AppData\Local\Temp\DV9VHTlHfccssYND2qAm\Ssjrth0UntGAF6S3jvQyYG0T.exe
  2⤵
  - Executes dropped EXE
  PID:716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3492 -ip 3492
1⤵
PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DV9VHTlHfccssYND2qAm\CLTlurMmtAKyVe7xebyeD5Ww.exe

Filesize
533KB

MD5
37375d2bbcce65e3a00f34b015bbb854

SHA1
141b1e199e6851d2ce3e0415c46d0577227c452d

SHA256
0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461

SHA512
6732051c39d8ad537f604157cce458b9a5f78ff01fb5d6cbc1a3afa6c205b2485f5088f8febfb418b29d558c799816af73dee84f52dab789808fc6b5ef599915

Download Submit
C:\Users\Admin\AppData\Local\Temp\DV9VHTlHfccssYND2qAm\Ssjrth0UntGAF6S3jvQyYG0T.exe

Filesize
1.1MB

MD5
6c4f3c584265f7c5b346356de3034244

SHA1
4fa91c02229d62e0d0765add00af13ac55fe54c0

SHA256
bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4

SHA512
fa19b642cdc4f616e798d61945c16c68c0e378de0e8de701d323727f19e2e3b138c360e91df2da4f19f9ccec90436595038a39c40a7ed4488e066066173782be

Download Submit
memory/440-33-0x0000000000C20000-0x0000000000CA1000-memory.dmp

Filesize
516KB

Download
memory/440-32-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/440-29-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/1436-5-0x00000000019D0000-0x00000000019D1000-memory.dmp

Filesize
4KB

Download
memory/1436-1-0x0000000001970000-0x0000000001971000-memory.dmp

Filesize
4KB

Download
memory/1436-0-0x0000000000548000-0x0000000000BB2000-memory.dmp

Filesize
6.4MB

Download
memory/1436-8-0x0000000000470000-0x0000000001456000-memory.dmp

Filesize
15.9MB

Download
memory/1436-9-0x0000000000470000-0x0000000001456000-memory.dmp

Filesize
15.9MB

Download
memory/1436-13-0x0000000000548000-0x0000000000BB2000-memory.dmp

Filesize
6.4MB

Download
memory/1436-14-0x0000000000470000-0x0000000001456000-memory.dmp

Filesize
15.9MB

Download
memory/1436-4-0x00000000019C0000-0x00000000019C1000-memory.dmp

Filesize
4KB

Download
memory/1436-26-0x0000000000548000-0x0000000000BB2000-memory.dmp

Filesize
6.4MB

Download
memory/1436-25-0x0000000000470000-0x0000000001456000-memory.dmp

Filesize
15.9MB

Download
memory/1436-6-0x0000000001F70000-0x0000000001F71000-memory.dmp

Filesize
4KB

Download
memory/1436-3-0x0000000001990000-0x0000000001991000-memory.dmp

Filesize
4KB

Download
memory/1436-7-0x0000000001F80000-0x0000000001F81000-memory.dmp

Filesize
4KB

Download
memory/1436-2-0x0000000001980000-0x0000000001981000-memory.dmp

Filesize
4KB

Download
memory/3492-28-0x0000000000C9B000-0x0000000000C9C000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing