Analysis

  • max time kernel
    72s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 17:35

General

  • Target

    1768-3-0x0000000000400000-0x0000000000643000-memory.exe

  • Size

    2.3MB

  • MD5

    7e0a6ca388e0797fd6526a14f39bd417

  • SHA1

    5d27f8be8c45fbda3c9904902840a26bfd0aaa1d

  • SHA256

    1b730d4ccf08b45aca57a32c191b1ae8a70156e171668b623d1a2b3fe4013744

  • SHA512

    c65357d93754d8e58301f7952b0d9f89a1d788230dcfc7bd53aa4e265a92b0bceecff4a8f08f3f7dd8d439527a3b58c172ff71369469741818939f0bcf1607a0

  • SSDEEP

    3072:c1VB1NFj5qD6o8KaxfE54HnnGiayl+beX8Ka5acUsRFrJra:c171jj5q62aOanGiqbIsUGFdra

Malware Config

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1768-3-0x0000000000400000-0x0000000000643000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\1768-3-0x0000000000400000-0x0000000000643000-memory.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 36
      2⤵
      • Program crash
      PID:1740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1688-0-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB