stealc | 28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0

General

Target
28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe
Size 1.5MB
Sample251002-fpw1gsxtfy
SHA256 28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0
MD5 2586eb2f3103535b240a59db341b416b
SHA1 a1a4e694235b788df1d02dc58773dd28a4315034
SHA512 9877beefab545c8aaaf4368cb281dac0229c4c89d0891c397b69950a0a6d4fb97f24c82709176bab772d444817d18d9a48673221acd1418b4d9bd7334eb54a66
SSDEEP 24576:Iirr7wkfroFk8FmfEIF4FksQoiYiImvbplbmBXqsWdTXZIat:IO7wkZb4Fk+iPzzbzdtL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

build discovery stealc spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

build

C2

http://162.252.198.81

Attributes

url_path
/9e22feccb8274d02.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 336 set thread context of 5524	336	28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe	78

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5524	28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe
5524	28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 336 wrote to memory of 5524	336	28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe	78
PID 336 wrote to memory of 5524	336	28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe	78
PID 336 wrote to memory of 5524	336	28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe	78
PID 336 wrote to memory of 5524	336	28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe	78
PID 336 wrote to memory of 5524	336	28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe	78
PID 336 wrote to memory of 5524	336	28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe	78
PID 336 wrote to memory of 5524	336	28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe	78
PID 336 wrote to memory of 5524	336	28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe	78
PID 336 wrote to memory of 5524	336	28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe	78
PID 5524 wrote to memory of 1732	5524	28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe	79
PID 5524 wrote to memory of 1732	5524	28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe	79
PID 5524 wrote to memory of 1732	5524	28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe	79

C:\Users\Admin\AppData\Local\Temp\28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe
"C:\Users\Admin\AppData\Local\Temp\28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:336
- C:\Users\Admin\AppData\Local\Temp\28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe
  "C:\Users\Admin\AppData\Local\Temp\28722ad42ae0e1cfeb16e0a95472e4f88dbeb2e6d2012e56e9b5faf6e06e5ef0.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1732

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

578C1A86-0071-828A-9D6E-6932D5D6E15A.txt

Path C:\ProgramData\578C1A86-0071-828A-9D6E-6932D5D6E15A.txt
Size 64B
SHA256 a3896b1c83be3160027e4e8321db4453032b8e2e350c602c15a4aec2c6e8e32c
MD5 916a5e37530e48dd45d6f239a967c6da
SHA1 a97edd26944d8bcad3c1aff884765f63f8489f44
SHA512 09fb2adcd0f6f807305cb66e5b9038da470937008dc01df01719647a8b443ec88b7eadeb7d0a81d2eb35131538ee248d71d0fef5575855d6e53c3f30514b88c2
MD5 SHA1 SHA512

Submit Download

memory/5524-0-0x0000000140000000-0x00000001400CE000-memory.dmp

Download

memory/5524-2-0x0000000140000000-0x00000001400CE000-memory.dmp

Download

memory/5524-3-0x0000000140000000-0x00000001400CE000-memory.dmp

Download

memory/5524-1-0x0000000140000000-0x00000001400CE000-memory.dmp

Download

memory/5524-27-0x0000000140000000-0x00000001400CE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads