stealc | b8b7a808db203297e81a594063ff70126bb8587c3293731f98bf93602c55af0d

General

Target
Fling-Standalone48.780.9864.exe
Size 3.4MB
Sample260122-vna4yshs2f
SHA256 41999a3d0da035ff8068905c90235ea50121329cb0661e38d745974ebf5e3ae2
MD5 cf64c7e2e3897ae5fce3d5414e3d1d27
SHA1 c333a821f1764abe2aed2c1ab27d2349f64e4264
SHA512 3ac217e166ea07cdffb13c949100cf707041c7ee8e842ae4f35e0c529064b610fadcca2782e6de8c8e08e2649487a381f529fda3a53ec31da5ba1394c71d2fb1
SSDEEP 49152:dcOFPISimLMS5M3B3Kul+XYbxzSv199mMc0NWd:F5z0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

f222 discovery stealc spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

F222

C2

http://198.251.89.149

Attributes

url_path
/e86b90f3097e4b27.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Fling-Standalone48.780.9864.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Fling-Standalone48.780.9864.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4588	Fling-Standalone48.780.9864.exe
4588	Fling-Standalone48.780.9864.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4588	4888	Fling-Standalone48.780.9864.exe	78
PID 4888 wrote to memory of 4588	4888	Fling-Standalone48.780.9864.exe	78
PID 4888 wrote to memory of 4588	4888	Fling-Standalone48.780.9864.exe	78
PID 4888 wrote to memory of 4588	4888	Fling-Standalone48.780.9864.exe	78
PID 4888 wrote to memory of 4588	4888	Fling-Standalone48.780.9864.exe	78
PID 4888 wrote to memory of 4588	4888	Fling-Standalone48.780.9864.exe	78
PID 4888 wrote to memory of 4588	4888	Fling-Standalone48.780.9864.exe	78
PID 4888 wrote to memory of 4588	4888	Fling-Standalone48.780.9864.exe	78
PID 4588 wrote to memory of 4912	4588	Fling-Standalone48.780.9864.exe	79
PID 4588 wrote to memory of 4912	4588	Fling-Standalone48.780.9864.exe	79
PID 4588 wrote to memory of 5080	4588	Fling-Standalone48.780.9864.exe	82
PID 4588 wrote to memory of 5080	4588	Fling-Standalone48.780.9864.exe	82

C:\Users\Admin\AppData\Local\Temp\Fling-Standalone48.780.9864.exe
"C:\Users\Admin\AppData\Local\Temp\Fling-Standalone48.780.9864.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Users\Admin\AppData\Local\Temp\Fling-Standalone48.780.9864.exe
  "C:\Users\Admin\AppData\Local\Temp\Fling-Standalone48.780.9864.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3AC806B4-706B-8048-C73C-4390DF449B58.txt

Path C:\ProgramData\3AC806B4-706B-8048-C73C-4390DF449B58.txt
Size 64B
SHA256 ebb7efb66711dd2b2df6a0a980cf82204af2e1c3ce8d0a1f687bc97df667490e
MD5 ade33eb081f583776c97dada4a90c811
SHA1 7302aa70ff202d1d6a23feef1735ff737d041476
SHA512 603b0ba4d6b6a0e6d24c66bff5e63105058a6d8a90dd1be89227b1941d48b0345c54ed9e95f05b1d646951229e1537519cef21839c62b272f86d6e0784e35077
TLSH
T1EBA02200BC03A823CE000082C80FEA883022A002CC08C8C0203C3C000A0B000C02000A
MD5 SHA1 SHA512 TLSH

Submit Download

3AC806B4-706B-8048-C73C-4390DF449B58.txt

Path C:\ProgramData\3AC806B4-706B-8048-C73C-4390DF449B58.txt
Size 64B
SHA256 c56ba08456d2d800548760b3bb20a63ad02476fd85d9aa3ba373226a04995811
MD5 a6f13c4416805d171cb57a15d0a4c257
SHA1 7f4fe9160ed28769e71f9309a1539ee86dadf95a
SHA512 a66207fb81291052041db24404fc9b492d544eee797f2a8455a56dda613732718a84c99d2d0d7464db8cd0ccfa17b04622a8a173e0ea8f48c5c81ce7214c58c9
TLSH
T1D3A0220BB80030A8ABAA0A222C3000E000F0222C88E30080000808CB8AC300A080A00F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4588-10-0x000000014006E000-0x000000014006F000-memory.dmp

Download

memory/4588-9-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/4588-8-0x0000000000180000-0x0000000000181000-memory.dmp

Download

memory/4588-31-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/4888-0-0x0000000000400000-0x0000000000776000-memory.dmp

Download

memory/4888-7-0x0000000000A10000-0x0000000000A36000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads