Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-12-2024 02:53
General
-
Target
214cd9c2199d60c6f940ccde93ac98d9474322ceb51801d5cddcf3912ff6f1b1.exe
-
Size
5.5MB
-
MD5
86ed0d8493c5cebaa1104e2d13ca0ada
-
SHA1
35b2b12272f20d9ac6e713415cf9bf20b88dfdba
-
SHA256
214cd9c2199d60c6f940ccde93ac98d9474322ceb51801d5cddcf3912ff6f1b1
-
SHA512
5e5b723edd2ff354014a41700531a7643bee3e3bf07e7827e31663a08693ce7ad20ba36f2e8a7ab97652b2acb6df9908ccb9b04aa984e7c4a0f4547defd1f911
-
SSDEEP
98304:J/GYeOKXgYPdqa+UNfN1uu+/btg0FO9hJ1fCX/7PybX2w69xX2a:tGovYPdqaxNfDuuYBg0E9T1fCX+69xXD
Score
10/10
Malware Config
Extracted
Family
stealc
Botnet
LogsDiller
C2
http://91.211.250.247
Attributes
-
url_path
/f53d7360a78c678c.php
Signatures
-
Stealc
Stealc is an infostealer written in C++.
-
Stealc family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\214cd9c2199d60c6f940ccde93ac98d9474322ceb51801d5cddcf3912ff6f1b1.exe"C:\Users\Admin\AppData\Local\Temp\214cd9c2199d60c6f940ccde93ac98d9474322ceb51801d5cddcf3912ff6f1b1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
-
Filesize
4KB
-
Filesize
10.4MB
-
Filesize
10.4MB
-
Filesize
10.4MB
-
Filesize
10.4MB
-
Filesize
2.5MB