0cf273cc694691c74c8b039fc1e9bd2ee0c367147e7d5f52a5571215bcc1fbe8

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
16/03/2025, 17:15

Target

Creal-Stealer-Main.exe
Size

19.3MB
MD5

32b2d8d09d68ec87e21808660bd90f3b
SHA1

da5504e599fdfd96fcf37bd07daa3be4bfa76ea6
SHA256

0cf273cc694691c74c8b039fc1e9bd2ee0c367147e7d5f52a5571215bcc1fbe8
SHA512

485b6d74d929b011400af38a2784bc88e057912a2722085c85dd7ce6180a6a090b6b8160a5f999e5980dc67d584e60b573257595c82bec7802fbb278be042609
SSDEEP

393216:oQtstvdqJr7M5liAdQJluwF3MnG3otl5cuahBo1edW3WpsZ5J:oQtstVA7M5lndQz3MGYN6bDW

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1044	Creal-Stealer-Main.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1044	Creal-Stealer-Main.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 1044	1012	Creal-Stealer-Main.exe	30
PID 1012 wrote to memory of 1044	1012	Creal-Stealer-Main.exe	30
PID 1012 wrote to memory of 1044	1012	Creal-Stealer-Main.exe	30

C:\Users\Admin\AppData\Local\Temp\Creal-Stealer-Main.exe
"C:\Users\Admin\AppData\Local\Temp\Creal-Stealer-Main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Users\Admin\AppData\Local\Temp\Creal-Stealer-Main.exe
  "C:\Users\Admin\AppData\Local\Temp\Creal-Stealer-Main.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1044

C:\Users\Admin\AppData\Local\Temp\_MEI10122\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit