Analysis
- max time kernel
93s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - submitted
07/11/2024, 11:16
General
- Target a2f82e1fb127047aabd0ce64b7958718.exe
- Size 732KB
- Sample241107-nc5qvstncm
- SHA256 379ecfa96bcbcc264df40c19c501a6ba61db00b7ce7217ed19eea503e548c0f9
Score
10/10
Malware Config
Extracted
Family
-
stealc
Botnet
-
LogsDiller
C2
-
http://95.215.204.131
Attributes
-
url_path
/f0592db368f6bb51.php
Signatures
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2f82e1fb127047aabd0ce64b7958718.exe"C:\Users\Admin\AppData\Local\Temp\a2f82e1fb127047aabd0ce64b7958718.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 10362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4668 -ip 46681⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4668-1-0x0000000002C40000-0x0000000002D40000-memory.dmp
memory/4668-2-0x0000000004900000-0x00000000049DA000-memory.dmp
memory/4668-3-0x0000000000400000-0x00000000006ED000-memory.dmp
memory/4668-6-0x0000000000400000-0x00000000006ED000-memory.dmp
memory/4668-5-0x0000000004900000-0x00000000049DA000-memory.dmp
memory/4668-4-0x0000000000400000-0x0000000002BBB000-memory.dmp