Overview

overview

10

Static

static

3

random.exe

windows10-ltsc_2021-x64

10

random.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    104s
  • max time network
    151s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250314-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    29/03/2025, 13:14 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    random.exe

  • Size

    1.7MB

  • MD5

    d20eda67a0693cb56f7cb8155259683c

  • SHA1

    e444a87e49ce539a49945abefeedf9e319cabb7d

  • SHA256

    fe6a1c9f0ba36efc7359452d246e2362492663eb469467632a116f98921cd6a3

  • SHA512

    5ac74605b396abd76dcdc70379a45878ef4bdefbcd2d5032593f22d91a98a0a4f8df81d68b68b94880f9405e92d1a7f8b0148c784a1d94cc48f04b7372334209

  • SSDEEP

    24576:oBv68FkWFoVWtNQVudpyYuvt39oQ2/1f7F/iZnKzr0eu18sEAIwOnUH:cCek8SWtqVudTUqjf78Znefu1sj

Score
10/10
stealctrumpdefense_evasiondiscoverystealer

Malware Config

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\random.exe
    "C:\Users\Admin\AppData\Local\Temp\random.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:4500

Network

  • flag-ru
    GET
    http://45.93.20.28/
    random.exe
    Remote address:
    45.93.20.28:80
    Request
    GET / HTTP/1.1
    Host: 45.93.20.28
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 29 Mar 2025 13:17:40 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 0
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-ru
    POST
    http://45.93.20.28/85a1cacf11314eb8.php
    random.exe
    Remote address:
    45.93.20.28:80
    Request
    POST /85a1cacf11314eb8.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----CFBAKEHIEBKJJJJJKKKE
    Host: 45.93.20.28
    Content-Length: 210
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 29 Mar 2025 13:17:40 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 8
    Keep-Alive: timeout=5, max=99
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-us
    DNS
    c.pki.goog
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    142.250.187.195
  • flag-gb
    GET
    http://c.pki.goog/r/r1.crl
    Remote address:
    142.250.187.195:80
    Request
    GET /r/r1.crl HTTP/1.1
    Cache-Control: max-age = 3000
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 304 Not Modified
    Date: Sat, 29 Mar 2025 13:11:00 GMT
    Expires: Sat, 29 Mar 2025 14:01:00 GMT
    Age: 493
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Cache-Control: public, max-age=3000
    Vary: Accept-Encoding
  • 45.93.20.28:80
    http://45.93.20.28/85a1cacf11314eb8.php
    http
    random.exe
    1.0kB
     677 B
     10
    6

    HTTP Request

    GET http://45.93.20.28/

    HTTP Response

    200

    HTTP Request

    POST http://45.93.20.28/85a1cacf11314eb8.php

    HTTP Response

    200
  • 142.250.187.195:80
    http://c.pki.goog/r/r1.crl
    http
    384 B
     354 B
     4
    3

    HTTP Request

    GET http://c.pki.goog/r/r1.crl

    HTTP Response

    304
  • 8.8.8.8:53
    c.pki.goog
    dns
    56 B
     107 B
     1
    1

    DNS Request

    c.pki.goog

    DNS Response

    142.250.187.195

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4500-0-0x0000000000CA0000-0x0000000001341000-memory.dmp

    Filesize

    6.6MB

    Download

  • memory/4500-1-0x0000000077AB5000-0x0000000077AB7000-memory.dmp

    Filesize

    8KB

    Download

  • memory/4500-2-0x0000000000CA1000-0x0000000000CB8000-memory.dmp

    Filesize

    92KB

    Download

  • memory/4500-3-0x0000000000CA0000-0x0000000001341000-memory.dmp

    Filesize

    6.6MB

    Download

  • memory/4500-4-0x0000000000CA0000-0x0000000001341000-memory.dmp

    Filesize

    6.6MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.