stealc | ba2b7661d08a71adb20c571a0c8eac65ba4d46a10b372d07ecf039a29232dff6

Analysis

max time kernel
93s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2024 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4488-1264-0x0000000000E30000-0x00000000014C0000-memory.exe
Size

6.6MB
MD5

e9342d179b246595f67cbda7df8cb437
SHA1

c3f011816edd33483a2a5846e9f0d087ab5d8895
SHA256

ba2b7661d08a71adb20c571a0c8eac65ba4d46a10b372d07ecf039a29232dff6
SHA512

be03b15eb7662669dde7876c2fd688fe1e408d869643eeda87d95601ed8246faf5e1dbef9944728b18a4e6056b707fa52316fb6fb4b1b000a562c9f59a0d83af
SSDEEP

98304:9egfdT7yDz18N/ZIwbZBfquEsXKs3BU3o9kY4/kB:I8XRF8uj6Cm3oG

Score

10^/10

stealc discovery stealer

Malware Config

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4652	884	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4488-1264-0x0000000000E30000-0x00000000014C0000-memory.exe

C:\Users\Admin\AppData\Local\Temp\4488-1264-0x0000000000E30000-0x00000000014C0000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\4488-1264-0x0000000000E30000-0x00000000014C0000-memory.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 216
  2⤵
  - Program crash
  PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 884 -ip 884
1⤵
PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-0-0x0000000000D80000-0x0000000001410000-memory.dmp

Filesize
6.6MB

Download