Malware analysis CreamInstaller.exe Malicious activity

Add for printing

File name:	CreamInstaller.exe
Full analysis:	https://app.any.run/tasks/0c8cd124-d5aa-4d71-bf0f-5d7610411cf9
Verdict:	Malicious activity
Threats:	Stealc is a stealer malware that targets victims’ sensitive data, which it exfiltrates from browsers, messaging apps, and other software. The malware is equipped with advanced features, including fingerprinting, control panel, evasion mechanisms, string obfuscation, etc. Stealc establishes persistence and communicates with its C2 server through HTTP POST requests. Stealc ist eine Stealer-Malware, die es auf die sensiblen Daten der Opfer abgesehen hat, die sie aus Browsern, Messaging-Apps und anderer Software exfiltriert. Die Malware ist mit fortschrittlichen Funktionen ausgestattet, darunter Fingerprinting, Bedienfeld, Umgehungsmechanismen, String-Verschleierung usw. Stealc stellt eine Persistenz her und kommuniziert mit seinem C2-Server über HTTP-POST-Anfragen. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	October 21, 2024, 13:21:26
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	stealer stealc
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	99C3A297F5B53C14969EAECB8E331176
SHA1:	C8C30112455A089CC4CBB0589F62527A28355502
SHA256:	10587047D5CA565A4535FC09AB8E5BF6978DDE0E5C76BA50A314213A240E6BAC
SSDEEP:	12288:Ww23YjMJPOl80px5RpsRVNPSmxWhdD8pWN5YGiLm1qyae4GQqzwqc:1YJml3wVNPSmx2dDHYnLXyalGzzf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- STEALC has been detected (SURICATA)
  - CreamInstaller.exe (PID: 6284)
- StealC has been detected
  - CreamInstaller.exe (PID: 6284)
- Connects to the CnC server
  - CreamInstaller.exe (PID: 6284)
- Stealers network behavior
  - CreamInstaller.exe (PID: 6284)
SUSPICIOUS
- Application launched itself
  - CreamInstaller.exe (PID: 6132)
- Reads security settings of Internet Explorer
  - CreamInstaller.exe (PID: 6284)
- Executes application which crashes
  - CreamInstaller.exe (PID: 6132)
- Windows Defender mutex has been found
  - CreamInstaller.exe (PID: 6284)
- Contacting a server suspected of hosting an CnC
  - CreamInstaller.exe (PID: 6284)
INFO
- Checks supported languages
  - CreamInstaller.exe (PID: 6132)
  - CreamInstaller.exe (PID: 6284)
- Creates files or folders in the user directory
  - CreamInstaller.exe (PID: 6284)
- Checks proxy server information
  - CreamInstaller.exe (PID: 6284)
- Reads the computer name
  - CreamInstaller.exe (PID: 6284)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win64 Executable (generic) (64.6)
.dll	\|	Win32 Dynamic Link Library (generic) (15.4)
.exe	\|	Win32 Executable (generic) (10.5)
.exe	\|	Generic Win/DOS Executable (4.6)
.exe	\|	DOS Executable Generic (4.6)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2024:10:20 19:23:27+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	14.41
CodeSize:	135168
InitializedDataSize:	372224
UninitializedDataSize:	-
EntryPoint:	0x6448
OSVersion:	6
ImageVersion:	-
SubsystemVersion:	6
Subsystem:	Windows GUI

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

134

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

3128

C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6132 -s 312

C:\Windows\SysWOW64\WerFault.exe

CreamInstaller.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Problem Reporting

Exit code:

Version:

10.0.19041.3996 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll

6132

"C:\Users\admin\AppData\Local\Temp\CreamInstaller.exe"

C:\Users\admin\AppData\Local\Temp\CreamInstaller.exe

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

3221225477

Modules

Images
c:\users\admin\appdata\local\temp\creaminstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\sechost.dll

6284

"C:\Users\admin\AppData\Local\Temp\CreamInstaller.exe"

C:\Users\admin\AppData\Local\Temp\CreamInstaller.exe

CreamInstaller.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\creaminstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

Add for printing

Total events

3 409

Read events

3 406

Write events

Delete events

Modification events


(PID) Process:	(6284) CreamInstaller.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(6284) CreamInstaller.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(6284) CreamInstaller.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3128	WerFault.exe	C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_CreamInstaller.e_69125464beca4d172c5e6bb23f14b1f4271e479_ab76e96a_1a3e6a58-a5c1-447b-8cab-fbe47a064d73\Report.wer		—
		MD5:—	SHA256:—
3128	WerFault.exe	C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC55.tmp.WERInternalMetadata.xml		xml
		MD5:F94300746B3901FA33BD0F1F955FA66B	SHA256:D0E2F40D4EAB5E69B04C8727DA547F966884FAB41BB6185018163B29CA7A99EF
3128	WerFault.exe	C:\ProgramData\Microsoft\Windows\WER\Temp\WERBBF6.tmp.dmp		dmp
		MD5:00F918F357F9B6225398205198FC2491	SHA256:E1C3F156D57E33A9D42F78FB5035F23D1FBD9E44AEEE817FE9F2CD6F91F8AC0C
3128	WerFault.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FE		der
		MD5:F0CF5B1794ECA7CD73F9C020DAAB8EF2	SHA256:2AF00EDCE7EF3266897E52DC81E8DE3B7A079028C0F1F96EAFF9E38AD342F617
3128	WerFault.exe	C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC84.tmp.xml		xml
		MD5:AF053275DFC8C9C32A38D2612045882D	SHA256:731C83B71CE2B21F98E2E6E90CB92A461828A025BDE01D871E322C429CDB0FBE
3128	WerFault.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785		der
		MD5:1B7FD5177461034E4086724C5845E927	SHA256:065AF18C229898A1C2A8D989911ADCD9B1E2AB14B1953EBF8EAF34AE37EA1627
3128	WerFault.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785		binary
		MD5:B2C7EA2FE7AF8688AF51309CB621D1FF	SHA256:5E0BF575F5E10501F125A27AE0EEF0A4612E8C8D0C973BE0EB6A5CB1524F33C5
3128	WerFault.exe	C:\Users\admin\AppData\Local\CrashDumps\CreamInstaller.exe.6132.dmp		binary
		MD5:441A4E4BF659E17684CA200B1D24E4D7	SHA256:F7E0DBFDB9F64BD6ADBE6A07C0BF7743907B0E8C19CD0EC676CF7199F6A65B81
3128	WerFault.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FE		binary
		MD5:B90799BAEEEFF501DDBF0CACDB8B95AF	SHA256:7F9348FED4B04004447ED6823BAE1035C0953CFF7820F51B6419F978F47E356C

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
6284	CreamInstaller.exe	POST	200	95.217.125.57:80	http://95.217.125.57/2f571d994666c8cb.php	unknown	—	—	malicious
6284	CreamInstaller.exe	GET	200	95.217.125.57:80	http://95.217.125.57/	unknown	—	—	malicious
3128	WerFault.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
3128	WerFault.exe	GET	200	2.16.164.49:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
4360	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
2076	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
5488	MoUsoCoreWorker.exe	GET	200	88.221.169.152:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5488	MoUsoCoreWorker.exe	GET	200	23.48.23.143:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
6200	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
6200	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
5700	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
5488	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6944	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
6284	CreamInstaller.exe	95.217.125.57:80	—	Hetzner Online GmbH	FI	malicious
3128	WerFault.exe	20.42.65.92:443	watson.events.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
3128	WerFault.exe	2.16.164.49:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
3128	WerFault.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
4360	SearchApp.exe	2.23.209.143:443	www.bing.com	Akamai International B.V.	GB	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 40.127.240.158	whitelisted
google.com	216.58.206.46	whitelisted
watson.events.data.microsoft.com	20.42.65.92	whitelisted
crl.microsoft.com	2.16.164.49 2.16.164.120 23.48.23.143 23.48.23.166 23.48.23.156	whitelisted
www.microsoft.com	95.101.149.131 88.221.169.152 184.30.21.171	whitelisted
www.bing.com	2.23.209.143 2.23.209.133 2.23.209.140 2.23.209.141 2.23.209.131 2.23.209.148 2.23.209.142 2.23.209.132 2.23.209.136	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
login.live.com	40.126.31.71 20.190.159.75 20.190.159.64 40.126.31.73 40.126.31.67 20.190.159.73 20.190.159.23 40.126.31.69	whitelisted
th.bing.com	2.23.209.153 2.23.209.156 2.23.209.166 2.23.209.168 2.23.209.162 2.23.209.169 2.23.209.154 2.23.209.167 2.23.209.160	whitelisted
go.microsoft.com	184.28.89.167	whitelisted

Threats

PID	Process	Class	Message
6284	CreamInstaller.exe	Malware Command and Control Activity Detected	STEALER [ANY.RUN] Stealc HTTP POST Request
6284	CreamInstaller.exe	Malware Command and Control Activity Detected	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Add for printing

No debug info

General Info

CreamInstaller.exe

99C3A297F5B53C14969EAECB8E331176

C8C30112455A089CC4CBB0589F62527A28355502

10587047D5CA565A4535FC09AB8E5BF6978DDE0E5C76BA50A314213A240E6BAC

12288:Ww23YjMJPOl80px5RpsRVNPSmxWhdD8pWN5YGiLm1qyae4GQqzwqc:1YJml3wVNPSmx2dDHYnLXyalGzzf

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

STEALC has been detected (SURICATA)

StealC has been detected

Connects to the CnC server

Stealers network behavior

SUSPICIOUS

Application launched itself

Reads security settings of Internet Explorer

Executes application which crashes

Windows Defender mutex has been found

Contacting a server suspected of hosting an CnC

INFO

Checks supported languages

Creates files or folders in the user directory

Checks proxy server information

Reads the computer name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings