Analysis
-
max time kernel
93s -
max time network
96s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250128-en -
resource tags
-
submitted
29-01-2025 21:04
General
-
Target
xrandom.exe
-
Size
1.3MB
-
MD5
2893a3033daf4b014031297ff29d157d
-
SHA1
a0abe889fc3b0ae8bfdbd0f4f56bc500f56d839f
-
SHA256
c41b3aeb361912b6e938ace351253dbd79d39ec3a8a8cfabf7e3b498ea1aac39
-
SHA512
2deaab343e02c898f51e9f3748ff26214f02e6427a9f82033ad5bccdcf6fb9f84cd52ef7659e9958d8b7de0b26e0585eb588bea15f7f259477807c80ac9921a1
-
SSDEEP
24576:xjYAY3dLBTYhZtsh9M9Z/MnXfCQNfV6HeyhrIuU/zxvuo3A8azMy8R:xYDNTYhZtW9QZUnXqitAEva8azw
Score
10/10
Malware Config
Extracted
Family
stealc
Botnet
default
C2
http://162.248.227.2
Attributes
-
url_path
/c978b91b47469f3f.php
Signatures
-
Stealc
Stealc is an infostealer written in C++.
-
Stealc family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\xrandom.exe"C:\Users\Admin\AppData\Local\Temp\xrandom.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
-
Filesize
1.3MB