stealc | 3d7c3cb1e497d0dff0ea61645e1332ed9987e31faac74a438e42ee01e1dc2017

Analysis

max time kernel
132s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2024 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3816-38-0x0000000000EA0000-0x0000000001547000-memory.exe
Size

6.7MB
MD5

31a93dc47fb39211c50d25df0ff8abac
SHA1

a421ebe5d5d2e16ea4a89862d1255f2b0430717d
SHA256

3d7c3cb1e497d0dff0ea61645e1332ed9987e31faac74a438e42ee01e1dc2017
SHA512

2ba47e89a71a82140b94b4dde8bc815ee9cadf41115dec678f732d304db5c01af7cc72788b3d1d11de5fb105bd2f85016407b4e2f15cf7f430c4ad3f4076823b
SSDEEP

98304:0KsSu7S37RFp9heW9yb78RpIzoYfhSUzUQR8EgahRNgSHWj2XOp:y7s9I7CpmuyF8EiSuk

Score

10^/10

stealc discovery stealer

Malware Config

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3144 4920 WerFault.exe 3816-38-0x0000000000EA0000-0x0000000001547000-memory.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

3816-38-0x0000000000EA0000-0x0000000001547000-memory.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3816-38-0x0000000000EA0000-0x0000000001547000-memory.exe

pid	pid_target	process	target process
3144	4920	WerFault.exe	3816-38-0x0000000000EA0000-0x0000000001547000-memory.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3816-38-0x0000000000EA0000-0x0000000001547000-memory.exe

C:\Users\Admin\AppData\Local\Temp\3816-38-0x0000000000EA0000-0x0000000001547000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3816-38-0x0000000000EA0000-0x0000000001547000-memory.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 216
2⤵
- Program crash
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4920 -ip 4920
1⤵
PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4920-0-0x00000000004A0000-0x0000000000B47000-memory.dmp

Filesize
6.7MB

Download