stealc | 965089245651accd26b2b1867f70efc9e3de47a4dfe8791247b04d6b9e0e9b32

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-12-2024 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

888-47-0x0000000000E70000-0x000000000136B000-memory.exe
Size

5.0MB
MD5

1125f8b070634b2d8bc25b4d744ef9a3
SHA1

208bf8c580826ec2b5780dbb436ac689c524ca43
SHA256

965089245651accd26b2b1867f70efc9e3de47a4dfe8791247b04d6b9e0e9b32
SHA512

b937888963a6553ce735c435054c39badfb7c93bc63d09e501d6b73cc72ad205622066f22c5ef7af4ecd2999a39777d61cdc8bac77f7696484a20ed3efe5a9e6
SSDEEP

49152:9VCe0qJm465b0VHmfU7GhXcdBn+VgEgaXRSK:6e0q44MQ5OUqhXuid9j

Score

10^/10

stealc discovery stealer

Malware Config

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2824	2848	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	888-47-0x0000000000E70000-0x000000000136B000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2824	2848	888-47-0x0000000000E70000-0x000000000136B000-memory.exe	30
PID 2848 wrote to memory of 2824	2848	888-47-0x0000000000E70000-0x000000000136B000-memory.exe	30
PID 2848 wrote to memory of 2824	2848	888-47-0x0000000000E70000-0x000000000136B000-memory.exe	30
PID 2848 wrote to memory of 2824	2848	888-47-0x0000000000E70000-0x000000000136B000-memory.exe	30

C:\Users\Admin\AppData\Local\Temp\888-47-0x0000000000E70000-0x000000000136B000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\888-47-0x0000000000E70000-0x000000000136B000-memory.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 36
  2⤵
  - Program crash
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2848-0-0x00000000008D0000-0x0000000000DCB000-memory.dmp

Filesize
5.0MB

Download