stealc | ad277a48c7c67f5510e0d2b28284f631f9e51dd7da53ed9e4da8dec0078d9aa0

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

503KB
MD5

926dd9e88e2ac846eaf3c23ef8208cdf
SHA1

95e642c98048b718b948425e39a746d66d0dd4db
SHA256

ad277a48c7c67f5510e0d2b28284f631f9e51dd7da53ed9e4da8dec0078d9aa0
SHA512

ff5c31b9ffe58b88983ba2c2f8f2195c454fe69f05a9d5a40aa90227461fb3a1994c778b026a723715ab5d3664702f47df84336afd5b495cd258a1514f75eb30
SSDEEP

12288:sA4gyTSwAN2kL0PPJHBlOyLwFrpOu6VSlC8OIlr7v:sxgFN2kL03HlpLwFrpOu6qC83r7v

Score

10^/10

stealc logsdiller1 discovery stealer

Malware Config

Extracted

Family

stealc

Botnet

LogsDiller1

http://109.107.157.132

Attributes

url_path
/7a5d4e643b804e99.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1752 set thread context of 2432	1752	file.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2432	1752	file.exe	31
PID 1752 wrote to memory of 2432	1752	file.exe	31
PID 1752 wrote to memory of 2432	1752	file.exe	31
PID 1752 wrote to memory of 2432	1752	file.exe	31
PID 1752 wrote to memory of 2432	1752	file.exe	31
PID 1752 wrote to memory of 2432	1752	file.exe	31
PID 1752 wrote to memory of 2432	1752	file.exe	31
PID 1752 wrote to memory of 2432	1752	file.exe	31
PID 1752 wrote to memory of 2432	1752	file.exe	31
PID 1752 wrote to memory of 2432	1752	file.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-0-0x00000000012AD000-0x00000000012AE000-memory.dmp

Filesize
4KB

Download
memory/2432-1-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/2432-2-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/2432-4-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/2432-3-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/2432-5-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/2432-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2432-8-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/2432-11-0x0000000001270000-0x00000000012EF000-memory.dmp

Filesize
508KB

Download
memory/2432-10-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download