Analysis
-
max time kernel
95s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-11-2024 01:33
Static task
static1
Behavioral task
behavioral1
Sample
36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe
Resource
win10v2004-20241007-en
General
-
Target
36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe
-
Size
455KB
-
MD5
19d0c3dec3923ac19cd4cf49239758a0
-
SHA1
99a3f171e11a11ed435600fd70e6350e5f273437
-
SHA256
36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdf
-
SHA512
5e897fbde813c6d155c5b38a601e0e64c6d1d94df6d1b5ea52015260fe3df64a6d3ff74809080117f7ebec3105e9e7480acb306c59ce567fed59a54fd7d79825
-
SSDEEP
6144:X9iWOkjOhJIeKST38AZ16Jx+pziOQu1n:X0ujOJOSTsAKY
Malware Config
Extracted
stealc
default9_cap
http://62.204.41.177
-
url_path
/edd20096ecef326d.php
Signatures
-
Stealc family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 264 3804 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exetimeout.exe36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid Process 436 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exepid Process 3804 36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe 3804 36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.execmd.exedescription pid Process procid_target PID 3804 wrote to memory of 5036 3804 36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe 88 PID 3804 wrote to memory of 5036 3804 36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe 88 PID 3804 wrote to memory of 5036 3804 36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe 88 PID 5036 wrote to memory of 436 5036 cmd.exe 93 PID 5036 wrote to memory of 436 5036 cmd.exe 93 PID 5036 wrote to memory of 436 5036 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe"C:\Users\Admin\AppData\Local\Temp\36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe" & del "C:\ProgramData\*.dll"" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:436
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 15402⤵
- Program crash
PID:264
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3804 -ip 38041⤵PID:4688