svcstealer | 7ef48d31b3c9cc5b2104a48159798474f9b79e9d336a64df9220ad93f28b14c0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/03/2025, 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SeedChecker6.exe
Size

22.4MB
MD5

9ab945e80efc5fad000a94a77465cc6c
SHA1

e60f7d0f3233b1c3053d51e661b94fb557eaa247
SHA256

7ef48d31b3c9cc5b2104a48159798474f9b79e9d336a64df9220ad93f28b14c0
SHA512

044ecd4736b7051af979e0f103f89ceb35105cf2be770f33a0772fdb8054d8fa2f9f5337629a6e3211657cebf8eb6fddccaadaf2d00d6bbc5ca2f71780a45a15
SSDEEP

393216:NKvFfBDdk/pSKafXTTAgOmsZTXhKbRXGBEWBVu4WRryVJGjFFqW4gwcS9:NWF5e/0KafXTENmojhcyEWToryVJ0Fo7

Score

10^/10

svcstealer downloader persistence stealer

Malware Config

Extracted

Family

svcstealer

http://185.81.68.156/bin/bot64.bin

Signatures

Detects SvcStealer Payload 1 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
behavioral1/files/0x00090000000120f9-7.dat	family_svcstealer

SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer
Svcstealer family
svcstealer

Executes dropped EXE 3 IoCs

pid	Process
2676	winsxs.exe
2768	AppLauncher.exe
1524	main.exe

Loads dropped DLL 12 IoCs

pid	Process
2092	SeedChecker6.exe
2092	SeedChecker6.exe
2092	SeedChecker6.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2768	AppLauncher.exe
1524	main.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\4A41BF66306A3061125641\\4A41BF66306A3061125641.exe"	winsxs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2676	winsxs.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2676	winsxs.exe
Token: SeSecurityPrivilege	2676	winsxs.exe
Token: SeTakeOwnershipPrivilege	2676	winsxs.exe
Token: SeLoadDriverPrivilege	2676	winsxs.exe
Token: SeSystemProfilePrivilege	2676	winsxs.exe
Token: SeSystemtimePrivilege	2676	winsxs.exe
Token: SeProfSingleProcessPrivilege	2676	winsxs.exe
Token: SeIncBasePriorityPrivilege	2676	winsxs.exe
Token: SeCreatePagefilePrivilege	2676	winsxs.exe
Token: SeBackupPrivilege	2676	winsxs.exe
Token: SeRestorePrivilege	2676	winsxs.exe
Token: SeShutdownPrivilege	2676	winsxs.exe
Token: SeDebugPrivilege	2676	winsxs.exe
Token: SeSystemEnvironmentPrivilege	2676	winsxs.exe
Token: SeRemoteShutdownPrivilege	2676	winsxs.exe
Token: SeUndockPrivilege	2676	winsxs.exe
Token: SeManageVolumePrivilege	2676	winsxs.exe
Token: 33	2676	winsxs.exe
Token: 34	2676	winsxs.exe
Token: 35	2676	winsxs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2676	2092	SeedChecker6.exe	30
PID 2092 wrote to memory of 2676	2092	SeedChecker6.exe	30
PID 2092 wrote to memory of 2676	2092	SeedChecker6.exe	30
PID 2092 wrote to memory of 2768	2092	SeedChecker6.exe	31
PID 2092 wrote to memory of 2768	2092	SeedChecker6.exe	31
PID 2092 wrote to memory of 2768	2092	SeedChecker6.exe	31
PID 2676 wrote to memory of 2708	2676	winsxs.exe	32
PID 2676 wrote to memory of 2708	2676	winsxs.exe	32
PID 2676 wrote to memory of 2708	2676	winsxs.exe	32
PID 2768 wrote to memory of 1524	2768	AppLauncher.exe	33
PID 2768 wrote to memory of 1524	2768	AppLauncher.exe	33
PID 2768 wrote to memory of 1524	2768	AppLauncher.exe	33

C:\Users\Admin\AppData\Local\Temp\SeedChecker6.exe
"C:\Users\Admin\AppData\Local\Temp\SeedChecker6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Users\Admin\AppData\Roaming\winsxs.exe
  "C:\Users\Admin\AppData\Roaming\winsxs.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2676 -s 748
    3⤵
    - Loads dropped DLL
    PID:2708
- C:\Users\Admin\AppData\Local\Temp\AppLauncher.exe
  "AppLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\main.exe
    C:\Users\Admin\AppData\Local\Temp\AppLauncher.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AppLauncher.exe

Filesize
22.0MB

MD5
2d2e175b65d8a3caacb3698cc9bfbec7

SHA1
080923f6d1200f2cfa0b21abfcf4347f3423cf10

SHA256
05fdb78b2cb5178db1b3c99641e9cb9492a7bf2a11e0c9a591da5ffa379035a2

SHA512
603ae7fb051a1bd1ea890ce68018c64b8c586278532283b742480da898f112ec0fad8b75bc2f1916461cfcc3459e8330f1bc726556fdce7212568d30252ecc6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\pytz\zoneinfo\Africa\Banjul

Filesize
148B

MD5
09a9397080948b96d97819d636775e33

SHA1
5cc9b028b5bd2222200e20091a18868ea62c4f18

SHA256
d2efac4e5f23d88c95d72c1db42807170f52f43dd98a205af5a92a91b9f2d997

SHA512
2eccf2515599ed261e96da3fbcfbab0b6a2dfc86a1d87e3814091709f0bfe2f600c3044c8555ed027978a8ae9045666ee639a8c249f48d665d8e5c60f0597799

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\pytz\zoneinfo\Africa\Djibouti

Filesize
265B

MD5
86dcc322e421bc8bdd14925e9d61cd6c

SHA1
289d1fb5a419107bc1d23a84a9e06ad3f9ee8403

SHA256
c89b2e253a8926a6cecf7eff34e4bfcdb7fe24daff22d84718c30deec0ea4968

SHA512
d32771be8629fb3186723c8971f06c3803d31389438b29bf6baa958b3f9db9a38971019583ba272c7a8f5eb4a633dfc467bfcb6f76faa8e290bad4fd7366bb2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\pytz\zoneinfo\Africa\Kigali

Filesize
149B

MD5
b07064beada5be6289ed9485ecc9733d

SHA1
b0ff96d087e4c86adb55b851c0d3800dfbb05e9a

SHA256
444ed3a710414bc6bf43eb27e591da49d3be3db153449a6a0c9473f7e39fdbcb

SHA512
0ce1322f4a6f6568cdf61fc699eead4147015829650e90d791c223b45f3a23ead720ff41b4c8cc10ee915175e052d4740347a4454d23c18a3c57d30ded5a904c

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\pytz\zoneinfo\Africa\Lagos

Filesize
235B

MD5
8244c4cc8508425b6612fa24df71e603

SHA1
30ba925b4670235915dddfa1dd824dd9d7295eac

SHA256
cffeb0282ccbd7fba0e493ff8677a1e5a6dd5197885042e437f95a773f844846

SHA512
560c7581dcb2c800eae779005e41406beaf15d24efc763304e3111b9bb6074fe0ba59c48b5a2c5511245551b94418bbc35934d9bd46313fcc6e383323056668c

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\pytz\zoneinfo\America\Curacao

Filesize
246B

MD5
adf95d436701b9774205f9315ec6e4a4

SHA1
fcf8be5296496a5dd3a7a97ed331b0bb5c861450

SHA256
8491e557ff801a8306516b8ca5946ff5f2e6821af31477eb47d7d191cc5a6497

SHA512
f8fceff3c346224d693315af1ab12433eb046415200abaa6cdd65fd0ad40673fdddf67b83563d351e4aa520565881a4226fb37d578d3ba88a135e596ebb9b348

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\pytz\zoneinfo\America\Panama

Filesize
182B

MD5
0972a9c4c28bf71eeab5f0bac573cdbc

SHA1
a94fbc2d567e41723f03629b6c9a864260108a17

SHA256
91ac80fe976931c490d058c8ce8b5d71ffa6d4961f6ca13ea9c153f0b0bccea0

SHA512
ece548f7d840a588523aacddc93891e0dd300390f79de063e60074e00a92ae33a8201642b841ff868387f1ac2188c485cce941d83c7a3617d27ac286dbcc0c17

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\pytz\zoneinfo\America\Toronto

Filesize
3KB

MD5
8dabdbbb4e33dcb0683c8a2db78fedc4

SHA1
a6d038ecff7126ee19ebb08a40d157c9a79964cd

SHA256
a587a1a1607439f7bac283e1815f2bdbafb9649a453d18e06c2e44e6996d888f

SHA512
35bfd5182535f5257d7ee693eb6827751993915129d7f3cc276783926b1f4db7a00d8f0b44a95ac80c294a9cc1b84bda6418134c2a5c10ba6c89946bd8ef97a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\pytz\zoneinfo\Asia\Shanghai

Filesize
561B

MD5
09dd479d2f22832ce98c27c4db7ab97c

SHA1
79360e38e040eaa15b6e880296c1d1531f537b6f

SHA256
64ffc2e43a94435a043c040d1d3af7e92d031adc78e7737af1861baa4eeef3e6

SHA512
f88ae25f3f04c7d5d5f98aafecc03cc7e4e56f1cd4c8deba6afd043f0fb7fe67b4d50e4df5493e77c6b34ba183e019442e736a13f784ba8c2847c06fd74ff200

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\pytz\zoneinfo\Etc\UCT

Filesize
114B

MD5
38bb24ba4d742dd6f50c1cba29cd966a

SHA1
d0b8991654116e9395714102c41d858c1454b3bd

SHA256
8b85846791ab2c8a5463c83a5be3c043e2570d7448434d41398969ed47e3e6f2

SHA512
194867d0cf66c2de4969dbfeb58c775964ecb2132acdc1b000b5ef0998cefde4a2979ffc04ec8b7dcb430e43326a79d9cedb28ecea184345aa7d742eaf9234ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\pytz\zoneinfo\Europe\Isle_of_Man

Filesize
3KB

MD5
a40006ee580ef0a4b6a7b925fee2e11f

SHA1
1beba7108ea93c7111dabc9d7f4e4bfdea383992

SHA256
c85495070dca42687df6a1c3ee780a27cbcb82f1844750ea6f642833a44d29b4

SHA512
316ecacc34136294ce11dcb6d0f292570ad0515f799fd59fbff5e7121799860b1347d802b6439a291f029573a3715e043009e2c1d5275f38957be9e04f92e62e

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\pytz\zoneinfo\Europe\Luxembourg

Filesize
2KB

MD5
355f0d3e2a3ee15ea78526f5eeb0cf7d

SHA1
d90f3247c4716c2e1068d5ad9c88ca2091bec4e8

SHA256
812f55aeb6e8cde9ddf4786e15eb4256b21e82cf5f5d28da1bad17d94570cac0

SHA512
96a5fa48a15167e55ffad5b0241c90caeb7f0433ad62dd43463a4c52c25c59f7357681cb586fc52e812e8173adc12cec9eff66d27d5f41e19d55f6c1fce12937

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\pytz\zoneinfo\Europe\Oslo

Filesize
2KB

MD5
7db6c3e5031eaf69e6d1e5583ab2e870

SHA1
918341ad71f9d3acd28997326e42d5b00fba41e0

SHA256
5ee475f71a0fc1a32faeb849f8c39c6e7aa66d6d41ec742b97b3a7436b3b0701

SHA512
688eaa6d3001192addaa49d4e15f57aa59f3dd9dc511c063aa2687f36ffd28ffef01d937547926be6477bba8352a8006e8295ee77690be935f76d977c3ea12fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\pytz\zoneinfo\Europe\Skopje

Filesize
1KB

MD5
6213fc0a706f93af6ff6a831fecbc095

SHA1
961a2223fd1573ab344930109fbd905336175c5f

SHA256
3a95adb06156044fd2fa662841c0268c2b5af47c1b19000d9d299563d387093a

SHA512
8149de3fd09f8e0f5a388f546ffe8823bdcda662d3e285b5cebc92738f0c6548ccb6ed2a5d086fd738cb3edc8e9e1f81c5e2e48edb0571e7ea7f131675b99327

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\pytz\zoneinfo\Greenwich

Filesize
114B

MD5
9cd2aef183c064f630dfcf6018551374

SHA1
2a8483df5c2809f1dfe0c595102c474874338379

SHA256
6d9f378883c079f86c0387a5547a92c449869d806e07de10084ab04f0249018d

SHA512
dafa0cb9d0a8e0ff75a19be499751ad85372aafa856ff06dd68ecf2b1c5578bb98a040becaecf0aed2c3e4ff7372ff200fe7614334756d19fe79dd61c01d4e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\pytz\zoneinfo\Pacific\Wallis

Filesize
152B

MD5
5bdd7374e21e3df324a5b3d178179715

SHA1
244ed7d52bc39d915e1f860727ecfe3f4b1ae121

SHA256
53268a8a6b11f0b8e02fc67683ae48d074efaf7b4c66e036c1478107afd9a7d7

SHA512
9c76f39e8795c50e6c5b384a7ff1f308a1c5173f42f810759b36cdeae7d33d1dac4934efeed580c59d988c152e2d7f8d9b8eb2073ab1fc15e4b9c10900c7b383

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\pytz\zoneinfo\Pacific\Yap

Filesize
172B

MD5
ec972f59902432836f93737f75c5116f

SHA1
331542d6faf6ab15ffd364d57fbaa62629b52b94

SHA256
9c1dfa1c15994dd8774e53f40cb14dcf529143468721f1dba7b2c2e14ae9f5f0

SHA512
e8e8c8f6d096c352d1244280254e4c6ecf93f7c2ff69ecc6fa4363a6be8a2daf6cfcd7f0d96bc2669268ced5565532fa06be348a139b0742ccccb83953c6324d

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\pytz\zoneinfo\US\Mountain

Filesize
2KB

MD5
648f67a7744849f2ca07f4d5871e9021

SHA1
faa7d6cf4178d032d8ba8a4d77eac0fd47f8a718

SHA256
32e819c00a43b3c348f539d700d425504f20b8d068c16418d26fa9b693e775c9

SHA512
3dab6d6a04a4856cba78ef499f1a436f1f71b1dea494ee098b76c1702531108ae0a1d7b6de05e9d9315027624b790e084d69b25507738099f6026cd2a9559f31

Download Submit
C:\Users\Admin\AppData\Roaming\winsxs.exe

Filesize
24KB

MD5
a029ef923434f51b8a6b84ad4242dc81

SHA1
c986a70d2d30f6fbf1f09afca6ea37c975c91667

SHA256
ae521af806652cd12f04b2c570e5eb33ca15584e602bd3c60ea7612eb7610903

SHA512
5f665274083570c61a83e0cd8993877d62bcc0efffb36f178f7aa7f7d2d9d4656e1b5f222c388842630c11ba75a3840099cf752c0d06c5d8075a24071d7b6609

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\main.exe

Filesize
11.5MB

MD5
35f1655f8d4815834b111f8a6f7ddce6

SHA1
9d4c5ad4f89c6702ce5c676edb5b63cfa5bcb9ae

SHA256
3f888d490b70217488c8857aa51db3f4f755312d3e999696c36fb416f038a602

SHA512
d4c19b8f704a515c79608b42959cfc3988b2c21f426af44a3f82616c43e81b68e5a4199c4ae856f97ec0bc9c0c2b62dddbbcb16cd9d79cf4b9de7082484e3aa1

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_2768_133859870560086000\python312.dll

Filesize
6.6MB

MD5
3c388ce47c0d9117d2a50b3fa5ac981d

SHA1
038484ff7460d03d1d36c23f0de4874cbaea2c48

SHA256
c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb

SHA512
e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

Download Submit