Analysis
-
max time kernel
94s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-12-2024 02:26
General
-
Target
f2ec88ec0b02c5c1dd3dcbb26cae45d73a228fc9fa30c48894c352e1b3a2a417.exe
-
Size
5.5MB
-
MD5
7a1c5b88f8ac5869e4316a6ee3d43ef0
-
SHA1
a685641eb078fe6749e8613791dc4bbd6cd3ae75
-
SHA256
f2ec88ec0b02c5c1dd3dcbb26cae45d73a228fc9fa30c48894c352e1b3a2a417
-
SHA512
28a9d975e445fe333642dfa0bb318aa877c817b9f26cdaf55a205a82ecd44db98a607b86447332c7217c75fb1337606b159444a1144c5f7f309e242296adb5d7
-
SSDEEP
98304:FzNnWb6RA70SkwVKHFluzQuB3qvppsJC/NiGSqR6jl0ARelQ/3fiYKWpXfhEvK5E:PWurFloQy3ypprF/e0Hly3gWdpEvE3+/
Score
10/10
Malware Config
Extracted
Family
stealc
Botnet
LogsDiller
C2
http://185.219.81.132
Attributes
-
url_path
/4bcb97a14f2e1544.php
Signatures
-
Stealc
Stealc is an infostealer written in C++.
-
Stealc family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2ec88ec0b02c5c1dd3dcbb26cae45d73a228fc9fa30c48894c352e1b3a2a417.exe"C:\Users\Admin\AppData\Local\Temp\f2ec88ec0b02c5c1dd3dcbb26cae45d73a228fc9fa30c48894c352e1b3a2a417.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
-
Filesize
4KB
-
Filesize
10.4MB
-
Filesize
10.4MB
-
Filesize
10.4MB
-
Filesize
10.4MB
-
Filesize
2.5MB