stealc | 3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-12-2024 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96.exe
Size

976.8MB
MD5

9eef61663c37e1dabc5e4de19a3313a3
SHA1

066a28ae74d8da84e143885a90c2e0ab8d0d7f9b
SHA256

3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96
SHA512

c50a09d8d4158b39918ffa73f05c77009ae07fbd05b8523b6be7b02bc2a67ece6880e5c60642a6f1887b43ea8ac5ac790131f845f7ac23666a710339f5b252fc
SSDEEP

6144:2sDnM7qRmzF9PvkeskjFfhmiMMFjCNDP2UhDc66APSIfLf5Pr3f2X:cqgnPRskjHmia2X

Score

10^/10

stealc default discovery stealer

Malware Config

Extracted

Family

stealc

Botnet

default

http://176.113.115.26

Attributes

url_path
/e50a8a413d120466.php

rc4.plain

Signatures

Detects Stealc stealer 4 IoCs

stealer

resource	yara_rule
behavioral1/memory/2668-8-0x0000000000400000-0x0000000000629000-memory.dmp	family_stealc
behavioral1/memory/2668-13-0x0000000000400000-0x0000000000629000-memory.dmp	family_stealc
behavioral1/memory/2668-12-0x0000000000400000-0x0000000000629000-memory.dmp	family_stealc
behavioral1/memory/2668-10-0x0000000000400000-0x0000000000629000-memory.dmp	family_stealc

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2504 set thread context of 2668	2504	JaffaCakes118_3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96.exe	31

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2668	2504	JaffaCakes118_3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96.exe	31
PID 2504 wrote to memory of 2668	2504	JaffaCakes118_3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96.exe	31
PID 2504 wrote to memory of 2668	2504	JaffaCakes118_3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96.exe	31
PID 2504 wrote to memory of 2668	2504	JaffaCakes118_3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96.exe	31
PID 2504 wrote to memory of 2668	2504	JaffaCakes118_3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96.exe	31
PID 2504 wrote to memory of 2668	2504	JaffaCakes118_3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96.exe	31
PID 2504 wrote to memory of 2668	2504	JaffaCakes118_3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96.exe	31
PID 2504 wrote to memory of 2668	2504	JaffaCakes118_3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96.exe	31
PID 2504 wrote to memory of 2668	2504	JaffaCakes118_3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96.exe	31
PID 2504 wrote to memory of 2668	2504	JaffaCakes118_3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504
- C:\windows\syswow64\explorer.exe
  "C:\windows\syswow64\explorer.exe"
  2⤵
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2504-0-0x00000000000E0000-0x000000000012A000-memory.dmp

Filesize
296KB

Download
memory/2504-11-0x00000000000E0000-0x000000000012A000-memory.dmp

Filesize
296KB

Download
memory/2668-8-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/2668-13-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/2668-12-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/2668-10-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download