stealc | 359ac7b1e8531ed6ce9f9a8e8cd8932f7a4fca0fc149008d702e395208c98cec

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

2.7MB
MD5

870feaab725b148208dd12ffabe33f9d
SHA1

9f3651ad5725848c880c24f8e749205a7e1e78c1
SHA256

bbf7154f14d736f0c8491fb9fb44d2f179cdb02d34ab54c04466fa0702ea7d55
SHA512

5bea301f85e6a55fd5730793b960442bc4dab92d0bf47e4e55c5490448a4a22ed6d0feb1dbe9d56d6b6ff8d06f163381807f83f467621f527bc6521857fc8e1a
SSDEEP

49152:C11fbWXfBeBqTww8Gkfoa0yeL8zj9JLF+lP/MatsfHVnZbhG3EVsMI62Pseaj/1n:QbWkuwwjkULhlPUatsfBxhsE

Score

10^/10

stealc anna2 discovery persistence privilege_escalation stealer

Malware Config

Extracted

Family

stealc

Botnet

ANNA2

https://safefiledownloadsoft.com

Attributes

url_path
/725c63b56c99aa26.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Loads dropped DLL 8 IoCs

Processes:

netsh.exeTraceFmt.exeWerFault.exe

pid process

2028 netsh.exe
2028 netsh.exe
2708 TraceFmt.exe
2492 WerFault.exe
2492 WerFault.exe
2492 WerFault.exe
2492 WerFault.exe
2492 WerFault.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 820 set thread context of 2028 820 Setup.exe netsh.exe

pid	process
2028	netsh.exe
2028	netsh.exe
2708	TraceFmt.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe

description	pid	process	target process
PID 820 set thread context of 2028	820	Setup.exe	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2492 2708 WerFault.exe TraceFmt.exe

pid	pid_target	process	target process
2492	2708	WerFault.exe	TraceFmt.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TraceFmt.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TraceFmt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	TraceFmt.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Setup.exenetsh.exeTraceFmt.exe

pid process

820 Setup.exe
820 Setup.exe
2028 netsh.exe
2028 netsh.exe
2708 TraceFmt.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

Setup.exenetsh.exe

pid process

820 Setup.exe
2028 netsh.exe

pid	process
820	Setup.exe
820	Setup.exe
2028	netsh.exe
2028	netsh.exe
2708	TraceFmt.exe

pid	process
820	Setup.exe
2028	netsh.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Setup.exenetsh.exeTraceFmt.exe

description	pid	process	target process
PID 820 wrote to memory of 2028	820	Setup.exe	netsh.exe
PID 820 wrote to memory of 2028	820	Setup.exe	netsh.exe
PID 820 wrote to memory of 2028	820	Setup.exe	netsh.exe
PID 820 wrote to memory of 2028	820	Setup.exe	netsh.exe
PID 820 wrote to memory of 2028	820	Setup.exe	netsh.exe
PID 2028 wrote to memory of 2708	2028	netsh.exe	TraceFmt.exe
PID 2028 wrote to memory of 2708	2028	netsh.exe	TraceFmt.exe
PID 2028 wrote to memory of 2708	2028	netsh.exe	TraceFmt.exe
PID 2028 wrote to memory of 2708	2028	netsh.exe	TraceFmt.exe
PID 2028 wrote to memory of 2708	2028	netsh.exe	TraceFmt.exe
PID 2708 wrote to memory of 2492	2708	TraceFmt.exe	WerFault.exe
PID 2708 wrote to memory of 2492	2708	TraceFmt.exe	WerFault.exe
PID 2708 wrote to memory of 2492	2708	TraceFmt.exe	WerFault.exe
PID 2708 wrote to memory of 2492	2708	TraceFmt.exe	WerFault.exe
PID 2028 wrote to memory of 2708	2028	netsh.exe	TraceFmt.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:820

C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netsh.exe
2⤵
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Local\Temp\TraceFmt.exe
C:\Users\Admin\AppData\Local\Temp\TraceFmt.exe
3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 284
4⤵
- Loads dropped DLL
- Program crash
PID:2492

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a014fb74
Filesize
1.3MB

MD5
192882e810e581aad16b3a052ba56349

SHA1
ba4e80a753a754cae631f569ce3f6e39bc7770b2

SHA256
19833264acebe7bb6fcc7c1aff1cf7dffb549081b0aa9d8419f4bc9984779e33

SHA512
88ec388cee7373b0fb14b96fd78abcb703c623379be46e69d512a347ba50757166d1ad53fd5287d8dce1e5b09aa162d5aa5123f186ad8927a9bb3962fc99d67d

Download Submit
\Users\Admin\AppData\Local\Temp\TraceFmt.exe
Filesize
433KB

MD5
fea067901f48a5f1faf7ca3b373f1a8f

SHA1
e8abe0deb87de9fe3bb3a611234584e9a9b17cce

SHA256
bf24b2f3e3a3c60ed116791b99e5421a4de34ac9c6e2201d34ab487e448ce152

SHA512
07c83a2d3d5dd475bc8aa48eba9b03e8fb742dbbd7bd623ed05dc1086efed7dfd1c1b8f037ee2e81efba1de58ea3243d7c84ac8b484e808cd28765f9c7517023

Download Submit
memory/820-0-0x0000000073FF0000-0x0000000074164000-memory.dmp

Filesize
1.5MB

Download
memory/820-1-0x0000000076EA0000-0x0000000077049000-memory.dmp

Filesize
1.7MB

Download
memory/820-5-0x0000000074002000-0x0000000074004000-memory.dmp

Filesize
8KB

Download
memory/820-6-0x0000000073FF0000-0x0000000074164000-memory.dmp

Filesize
1.5MB

Download
memory/820-7-0x0000000073FF0000-0x0000000074164000-memory.dmp

Filesize
1.5MB

Download
memory/2028-13-0x0000000073FF0000-0x0000000074164000-memory.dmp

Filesize
1.5MB

Download
memory/2028-11-0x0000000076EA0000-0x0000000077049000-memory.dmp

Filesize
1.7MB

Download
memory/2028-14-0x0000000073FF0000-0x0000000074164000-memory.dmp

Filesize
1.5MB

Download
memory/2028-10-0x0000000073FF0000-0x0000000074164000-memory.dmp

Filesize
1.5MB

Download
memory/2028-22-0x0000000073FF0000-0x0000000074164000-memory.dmp

Filesize
1.5MB

Download
memory/2708-23-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/2708-25-0x0000000076EA0000-0x0000000077049000-memory.dmp

Filesize
1.7MB

Download
memory/2708-26-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/2708-28-0x0000000000EB5000-0x0000000000EBD000-memory.dmp

Filesize
32KB

Download
memory/2708-29-0x0000000000E70000-0x0000000000F2A000-memory.dmp

Filesize
744KB

Download
memory/2708-35-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/2708-36-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads