Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-01-2025 18:44
General
-
Target
1f991fedca06e5fb34e95c1f28ef49e7a13be07ca58312bdd1b1be1791bb23db.exe
-
Size
1.7MB
-
MD5
bef57112e098b157881a06a653b91b1d
-
SHA1
dc1efb36dc01e2392d6bcc8e38a6977d1449a096
-
SHA256
1f991fedca06e5fb34e95c1f28ef49e7a13be07ca58312bdd1b1be1791bb23db
-
SHA512
161a383985aa9eaa87b9ff3f82cb7864649b937f696bd50940e90a5f613165b8487f8d0a81a36928a6887f5464abcf4fd4624173614536953b94486197413a52
-
SSDEEP
49152:k9RtRaANqqWcVHp/Wh/v9XohCbPtA5q1T:UXUWWk/WhVoYZZ
Score
10/10
Malware Config
Extracted
Family
stealc
Botnet
stok
C2
http://185.215.113.206
Attributes
-
url_path
/c4becf79229cb002.php
Signatures
-
Stealc
Stealc is an infostealer written in C++.
-
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f991fedca06e5fb34e95c1f28ef49e7a13be07ca58312bdd1b1be1791bb23db.exe"C:\Users\Admin\AppData\Local\Temp\1f991fedca06e5fb34e95c1f28ef49e7a13be07ca58312bdd1b1be1791bb23db.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
-
Filesize
8KB
-
Filesize
92KB
-
Filesize
6.6MB
-
Filesize
6.6MB