751stealer | e995ef48247c9e019d9110e09b6b3c2f8ec9a2ca4982e30a75a55ba29dfd0964

General

Target
Zero Generator.exe
Size 1.8MB
Sample260910-tlv6nsdf85
SHA256 e995ef48247c9e019d9110e09b6b3c2f8ec9a2ca4982e30a75a55ba29dfd0964
MD5 a7743c9dcafc045c5b4ed78c3a2a634d
SHA1 957343897ceb6656516a4ade4fc0e2af931c3ceb
SHA512 7f3d1c771d1e6521c4c44945fedbcb3d925921b93d48decd8aef7f859a5ab9d5a7ce0a3aae69741d2340734b6eee09bb48197ed18237d5d84b6819a6218029c0
SSDEEP 49152:f/1ufdxsd4Y+rMZrbVtRFb9rmm+GJ0uX:Vuf3s7OM9VNNmmsuX
TLSH
T1CF95E189959000F9C5A3DB78DF7B198AF372B8839B75614733980A925F73360DE2B721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

751stealer persistence stealer

Malware Config

Extracted

Family

751stealer

C2

http://stealer.best

Attributes

owner_id
8da0e2f45f6c4e04

Signatures

Family: 751Stealer
751 Stealer is a Windows infostealer distributed as a .NET 8 single-file bundle that grabs browser data, files, and crypto wallets.
stealer 751stealer

Adds policy Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VCSpawn = "C:\\Program Files\\Microsoft Visual Studio\\VC\\bin\\vcspawn.exe"	vcspawn.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vcspawn.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	vcspawn.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	vcspawn.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Zero Generator.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	vcspawn.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	vcspawn.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	vcspawn.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	vcspawn.exe

Executes dropped EXE 8 IoCs

pid	Process
1920	vcspawn.exe
4596	vcspawn.exe
4688	vcspawn.exe
3920	vcspawn.exe
752	vcspawn.exe
1060	vcspawn.exe
4008	vcspawn.exe
3044	vcspawn.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	Zero Generator.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe	Zero Generator.exe
File opened for modification	C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe	Zero Generator.exe
File created	C:\Program Files\Microsoft Visual Studio\VC\bin\~vc_test.tmp	vcspawn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 1920	4268	Zero Generator.exe	86
PID 1920 wrote to memory of 4596	1920	vcspawn.exe	88
PID 4596 wrote to memory of 4688	4596	vcspawn.exe	98
PID 4688 wrote to memory of 3920	4688	vcspawn.exe	99
PID 4596 wrote to memory of 752	4596	vcspawn.exe	102
PID 3920 wrote to memory of 1060	3920	vcspawn.exe	103
PID 752 wrote to memory of 4008	752	vcspawn.exe	104
PID 1060 wrote to memory of 3044	1060	vcspawn.exe	105

C:\Users\Admin\AppData\Local\Temp\Zero Generator.exe
"C:\Users\Admin\AppData\Local\Temp\Zero Generator.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
  "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
  2⤵
  - Adds policy Run key to start application
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
    "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 1920
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
      "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
      4⤵
      Adds policy Run key to start application
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:4688
    - - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 4688
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3920
      - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
        6⤵
        Adds policy Run key to start application
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 1060
        7⤵
        Executes dropped EXE
        
        PID:3044
  - - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
      "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe"
      4⤵
      Adds policy Run key to start application
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:752
    - - C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
        
        "C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe" --watchdog 752
        5⤵
        Executes dropped EXE
        
        PID:4008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcspawn.exe

Path C:\Program Files\Microsoft Visual Studio\VC\bin\vcspawn.exe
Size 1.8MB
SHA256 e995ef48247c9e019d9110e09b6b3c2f8ec9a2ca4982e30a75a55ba29dfd0964
MD5 a7743c9dcafc045c5b4ed78c3a2a634d
SHA1 957343897ceb6656516a4ade4fc0e2af931c3ceb
SHA512 7f3d1c771d1e6521c4c44945fedbcb3d925921b93d48decd8aef7f859a5ab9d5a7ce0a3aae69741d2340734b6eee09bb48197ed18237d5d84b6819a6218029c0
SSDEEP 49152:f/1ufdxsd4Y+rMZrbVtRFb9rmm+GJ0uX:Vuf3s7OM9VNNmmsuX
TLSH
T1CF95E189959000F9C5A3DB78DF7B198AF372B8839B75614733980A925F73360DE2B721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads