stealc | 0e6fc77a72dd0b4c8f8fe7607c92eac7cf5b0d607c9904e09d9fb1b2128a2e51

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-11-2024 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

-pril-main/pothjadwtrgh.exe
Size

868KB
MD5

ca5762b75aecc07225105e53f65b8802
SHA1

9abd37e3eda743422a7240ed8caacc0ab12ec7d7
SHA256

f7182909f0bf61829d5fab95d5211e8b21e186247a5265d6cae1cacc77eca0fb
SHA512

a36b9512b772b51e926e42e32d78510cf585ecac7ff19fce0de8f692e00b5394de3ff209b0c06bdc99e36c723cac8a73e0ad02363119484a944d3c246a430e90
SSDEEP

24576:maIXlg5MGNL/geFyNcTN+jv75TQn652VBuNyb:zIXlgiGJtF4ch+jvNm0Nyb

Score

10^/10

stealc 7140196255 discovery stealer

Malware Config

Extracted

Family

stealc

Botnet

7140196255

http://83.217.209.11

Attributes

url_path
/fd2453cf4b7dd4a4.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pothjadwtrgh.exe

C:\Users\Admin\AppData\Local\Temp\-pril-main\pothjadwtrgh.exe
"C:\Users\Admin\AppData\Local\Temp\-pril-main\pothjadwtrgh.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2132-0-0x0000000000EC0000-0x00000000011AD000-memory.dmp

Filesize
2.9MB

Download
memory/2132-1-0x0000000000EC0000-0x00000000011AD000-memory.dmp

Filesize
2.9MB

Download