Analysis
-
max time kernel
44s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-10-2024 16:53
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
General
-
Target
file.exe
-
Size
868KB
-
MD5
f793d9e588c6bf51f1daf523ab2df1ce
-
SHA1
f63ce1f9eee9f3ae643e270c7fc854dc51d730d0
-
SHA256
a8addc675fcc27c94ff9e4775bb2e090f4da1287aae6b95cecc65ccf533bc61d
-
SHA512
4d0d8bf366f4b4793154f31aee4983df307b97edc83608b76628168418d48227eb46f6213469eb4d3a088d891a143b30b3b02acbb194df834da1b61d182607eb
-
SSDEEP
24576:Le1Q/llWMGNL/geFyNcTN+jv75TQn652VBuNyb:cQ/lldGJtF4ch+jvNm0Nyb
Malware Config
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Signatures
-
Stealc family
-
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 2796 chrome.exe 1244 chrome.exe 868 chrome.exe 1316 chrome.exe -
Loads dropped DLL 1 IoCs
pid Process 2072 file.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2292 2072 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString file.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2072 file.exe 2072 file.exe 2796 chrome.exe 2796 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe Token: SeShutdownPrivilege 2796 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe 2796 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2796 2072 file.exe 32 PID 2072 wrote to memory of 2796 2072 file.exe 32 PID 2072 wrote to memory of 2796 2072 file.exe 32 PID 2072 wrote to memory of 2796 2072 file.exe 32 PID 2796 wrote to memory of 2836 2796 chrome.exe 33 PID 2796 wrote to memory of 2836 2796 chrome.exe 33 PID 2796 wrote to memory of 2836 2796 chrome.exe 33 PID 2796 wrote to memory of 2604 2796 chrome.exe 34 PID 2796 wrote to memory of 2604 2796 chrome.exe 34 PID 2796 wrote to memory of 2604 2796 chrome.exe 34 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2608 2796 chrome.exe 36 PID 2796 wrote to memory of 2652 2796 chrome.exe 37 PID 2796 wrote to memory of 2652 2796 chrome.exe 37 PID 2796 wrote to memory of 2652 2796 chrome.exe 37 PID 2796 wrote to memory of 2816 2796 chrome.exe 38 PID 2796 wrote to memory of 2816 2796 chrome.exe 38 PID 2796 wrote to memory of 2816 2796 chrome.exe 38 PID 2796 wrote to memory of 2816 2796 chrome.exe 38 PID 2796 wrote to memory of 2816 2796 chrome.exe 38 PID 2796 wrote to memory of 2816 2796 chrome.exe 38 PID 2796 wrote to memory of 2816 2796 chrome.exe 38 PID 2796 wrote to memory of 2816 2796 chrome.exe 38 PID 2796 wrote to memory of 2816 2796 chrome.exe 38 PID 2796 wrote to memory of 2816 2796 chrome.exe 38 PID 2796 wrote to memory of 2816 2796 chrome.exe 38 PID 2796 wrote to memory of 2816 2796 chrome.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"2⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6ea9758,0x7fef6ea9768,0x7fef6ea97783⤵PID:2836
-
-
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:2604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1128 --field-trial-handle=1272,i,6533255193375793271,15465968102445289303,131072 /prefetch:23⤵PID:2608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1272,i,6533255193375793271,15465968102445289303,131072 /prefetch:83⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1272,i,6533255193375793271,15465968102445289303,131072 /prefetch:83⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2268 --field-trial-handle=1272,i,6533255193375793271,15465968102445289303,131072 /prefetch:13⤵
- Uses browser remote debugging
PID:868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2276 --field-trial-handle=1272,i,6533255193375793271,15465968102445289303,131072 /prefetch:13⤵
- Uses browser remote debugging
PID:1244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1572 --field-trial-handle=1272,i,6533255193375793271,15465968102445289303,131072 /prefetch:23⤵PID:640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2196 --field-trial-handle=1272,i,6533255193375793271,15465968102445289303,131072 /prefetch:13⤵
- Uses browser remote debugging
PID:1316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3472 --field-trial-handle=1272,i,6533255193375793271,15465968102445289303,131072 /prefetch:83⤵PID:1268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3596 --field-trial-handle=1272,i,6533255193375793271,15465968102445289303,131072 /prefetch:83⤵PID:912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3812 --field-trial-handle=1272,i,6533255193375793271,15465968102445289303,131072 /prefetch:83⤵PID:1508
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 7722⤵
- Program crash
PID:2292
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2472
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1KB
MD5f739583f37202e8c2ac5fa56cce98d62
SHA197914a591185122bbf87b9ca5a2e4a750e675a44
SHA256605aa46d765e31220e127120b783ccf4c416c0b626cf9279eac3dc6f6248535c
SHA512eee77343a3cad07b9881a685e22e6c0559b222f4069dfb76e58291d190ecfbca2db3b35e8138f70009a412b5d2b0c055366cc1a19ca5085289b94d1f5d19793c
-
Filesize
5KB
MD55ae8943c4a08d73f53f31632f908d744
SHA1fcbfed93f86192f8ff425fc3b1816b238f4f4235
SHA2567673365f69d9bb6a2d114afeb52541ebeb8cd4f7122c71aac693b622a3041e4f
SHA5122cbfbb04cb8af547c6eda9b5b7d0702cee7bf5d79474948347d24dc2611653e0d668d0b16b5305e274a88d2f1c95136895c8a159f4ad4caf3c7c94631a4ada5f
-
Filesize
5KB
MD543c448044ec4f0fadcf6fb09a3bee1de
SHA1a66b516a805beca5fea5f04fa3fcc35e2628fcbc
SHA2567b718098cab1a403c5210fc45aa6b6d8050a67ae1d0c8afea4619e9819b86980
SHA512db27b0bfa8d2399df7f8cf4e30fec61fecae2499e2be2ad67410eae170902fbced702777cc7a45a127d497574dd78b7de0cbe81a575719925d63f50b69688097
-
Filesize
676KB
MD5eda18948a989176f4eebb175ce806255
SHA1ff22a3d5f5fb705137f233c36622c79eab995897
SHA25681a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4
SHA512160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85