Analysis
- max time kernel
149s - max time network
132s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
02/12/2025, 16:28
General
- Target 2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe
- Size 5.0MB
- Sample251202-tyzdvsvmdw
- SHA256 a0c4faaa16d893503f915c69548418a9f1500236885b16026a8e6758f7d414aa
Malware Config
Extracted
-
stealc
-
1111
-
http://37.221.66.19
-
url_path
/05f640dd85154ef9.php
Signatures
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe"C:\Users\Admin\AppData\Local\Temp\2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\pLFit9mtTjjP.exe"C:\Users\Admin\AppData\Local\pLFit9mtTjjP.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\3Q3i4Z0vlH7D.exe"C:\Users\Admin\AppData\Local\3Q3i4Z0vlH7D.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3Q3i4Z0vlH7D.exe
pLFit9mtTjjP.exe
memory/752-47-0x0000000140000000-0x0000000140188000-memory.dmp
memory/752-980-0x0000000140000000-0x0000000140188000-memory.dmp
memory/1812-130-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-140-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-57-0x0000000000900000-0x00000000009B6000-memory.dmp
memory/1812-979-0x0000000005410000-0x000000000541A000-memory.dmp
memory/1812-978-0x0000000005590000-0x0000000005622000-memory.dmp
memory/1812-977-0x0000000005B40000-0x00000000060E6000-memory.dmp
memory/1812-74-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-76-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-78-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-124-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-80-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-59-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-118-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-106-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-84-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-72-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-70-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-68-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-64-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-62-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-60-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-66-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-150-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-157-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-154-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-152-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-148-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-146-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-142-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-92-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-138-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-136-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-134-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-132-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-58-0x0000000004F30000-0x0000000004FFA000-memory.dmp
memory/1812-128-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-126-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-144-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-975-0x0000000005130000-0x0000000005184000-memory.dmp
memory/1812-122-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-120-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-116-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-114-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-112-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-110-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-109-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-104-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-102-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-100-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-98-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-96-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-94-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-976-0x0000000005180000-0x00000000051CC000-memory.dmp
memory/1812-82-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-86-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-88-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/1812-90-0x0000000004F30000-0x0000000004FF3000-memory.dmp
memory/2648-8-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/2648-645-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/2648-15-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/2648-14-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/2648-3-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/2648-2-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/2648-1-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/2648-5-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/2648-4-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/2648-7-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/2648-6-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/2648-9-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/2648-10-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/2648-11-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/2648-13-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/2648-12-0x0000000140000000-0x00000001400C3000-memory.dmp