Malware analysis 9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe Malicious activity

Add for printing

File name:	9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe
Full analysis:	https://app.any.run/tasks/522d184e-8c26-47b8-ad6b-076b0100e221
Verdict:	Malicious activity
Threats:	Stealc is a stealer malware that targets victims’ sensitive data, which it exfiltrates from browsers, messaging apps, and other software. The malware is equipped with advanced features, including fingerprinting, control panel, evasion mechanisms, string obfuscation, etc. Stealc establishes persistence and communicates with its C2 server through HTTP POST requests. Stealc ist eine Stealer-Malware, die es auf die sensiblen Daten der Opfer abgesehen hat, die sie aus Browsern, Messaging-Apps und anderer Software exfiltriert. Die Malware ist mit fortschrittlichen Funktionen ausgestattet, darunter Fingerprinting, Bedienfeld, Umgehungsmechanismen, String-Verschleierung usw. Stealc stellt eine Persistenz her und kommuniziert mit seinem C2-Server über HTTP-POST-Anfragen. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	April 17, 2024, 13:14:54
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	stealer stealc
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	ECA5C416B7B17D0308AECD5EE460884E
SHA1:	E4FD9437D9157D4817A3398D8B7321DFF3C394E1
SHA256:	9D5903667AD215AC4EFB3346C2179AC6BF5CA7FA3A9EFCB6CEEC6C53421434B4
SSDEEP:	12288:OjrIecsqIUvWcuCcvltQJ/5uTpY8ysdyVVVVV:0hqIMUA5uTpY8ys

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Add for printing

MALICIOUS
- Drops the executable file immediately after the start
  - 9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe (PID: 980)
- Connects to the CnC server
  - 9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe (PID: 980)
- STEALC has been detected (SURICATA)
  - 9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe (PID: 980)
SUSPICIOUS
- Executes application which crashes
  - 9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe (PID: 980)
- Reads security settings of Internet Explorer
  - 9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe (PID: 980)
- Windows Defender mutex has been found
  - 9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe (PID: 980)
INFO
- Checks proxy server information
  - WerFault.exe (PID: 4184)
  - 9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe (PID: 980)
- Reads the computer name
  - 9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe (PID: 980)
- Checks supported languages
  - 9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe (PID: 980)
- Reads the software policy settings
  - WerFault.exe (PID: 4184)
- Creates files or folders in the user directory
  - WerFault.exe (PID: 4184)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win32 Executable (generic) (42.6)
.exe	\|	Clipper DOS Executable (19.1)
.exe	\|	Generic Win/DOS Executable (18.9)
.exe	\|	DOS Executable Generic (18.9)
.vxd	\|	VXD Driver (0.2)

EXIF

EXE

ProductVersions:	73.14.66.60
ProductName:	Smelfie
OriginalFileName:	Fires
FileDescription:	Bill
InternalName:	Hole
CharacterSet:	Unknown (24E6)
LanguageCode:	Farsi
FileSubtype:	-
ObjectFileType:	Unknown
FileOS:	Unknown (0x20823)
FileFlags:	(none)
FileFlagsMask:	0x950a
ProductVersionNumber:	83.0.0.0
FileVersionNumber:	42.0.0.0
Subsystem:	Windows GUI
SubsystemVersion:	5.1
ImageVersion:	-
OSVersion:	5.1
EntryPoint:	0x6835
UninitializedDataSize:	-
InitializedDataSize:	43060736
CodeSize:	102400
LinkerVersion:	12
PEType:	PE32
ImageFileCharacteristics:	No relocs, Executable, 32-bit
TimeStamp:	2023:08:21 07:21:15+00:00
MachineType:	Intel 386 or later, and compatibles

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

130

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

980

"C:\Users\admin\AppData\Local\Temp\9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe"

C:\Users\admin\AppData\Local\Temp\9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

3221225622

Modules

Images
c:\users\admin\appdata\local\temp\9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

4184

C:\WINDOWS\SysWOW64\WerFault.exe -u -p 980 -s 1308

C:\Windows\SysWOW64\WerFault.exe

9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Problem Reporting

Exit code:

Version:

10.0.19041.3996 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll

6488

C:\WINDOWS\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\SppExtComObj.Exe

—

svchost.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

KMS Connection Broker

Version:

10.0.19041.3996 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll

3240

"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent

C:\Windows\System32\slui.exe

—

SppExtComObj.Exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

Add for printing

Total events

4 438

Read events

4 427

Write events

Delete events

Modification events


(PID) Process:	(980) 9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(980) 9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(980) 9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(980) 9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(980) 9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1
(PID) Process:	(980) 9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 1
(PID) Process:	(980) 9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
4184	WerFault.exe	C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_9d5903667ad215ac_15ca612d9ad67f79ce585e15a49cbe061d28_7e915c94_fb532c3a-91be-4703-8060-362cf5f889de\Report.wer		—
		MD5:—	SHA256:—
4184	WerFault.exe	C:\Users\admin\AppData\Local\CrashDumps\9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe.980.dmp		dmp
		MD5:7BECC855A26264427AAAA195A5F218AA	SHA256:9471138F680CAD47AEFBBA005C11DF9DCDB93686B5014F406CC63A12BE530815
4184	WerFault.exe	C:\ProgramData\Microsoft\Windows\WER\Temp\WER426B.tmp.dmp		binary
		MD5:1A346854DE2B1FC31980998B52BA04BA	SHA256:F3D0F0B7E6EAFA6D3D57685BE29B9F023794A6B3E6BB45EF36C8FF0B44CC5851
4184	WerFault.exe	C:\ProgramData\Microsoft\Windows\WER\Temp\WER4329.tmp.xml		xml
		MD5:B69B0E7B45D8F8F982B6D93D2BC0D703	SHA256:3E856E7F98BF1F93594AAD528688B1C1492C5F22620762120153EC9F46D387E1
4184	WerFault.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785		—
		MD5:23E663AD81C9272BE5114F8C7E4DD1D5	SHA256:—
4184	WerFault.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785		binary
		MD5:9DA7886BBF310888E9ECACEBB78C52F1	SHA256:DBD816868E491C69ABEABC55478389D18BB7E2F2E8C40488020EAF9D6255EAC9
4184	WerFault.exe	C:\ProgramData\Microsoft\Windows\WER\Temp\WER4309.tmp.WERInternalMetadata.xml		xml
		MD5:7A5BDE2552E33BBF04CFBC0009EBF352	SHA256:2CD600397C4D8BCC127631AB9796D77AF26A655097162E8ADF6BA4F7F933BAB6

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
4464	SIHClient.exe	GET	200	23.200.213.221:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	unknown
1996	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	unknown
1924	svchost.exe	GET	200	23.200.213.221:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	unknown
2980	svchost.exe	GET	—	23.36.165.138:80	http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl	unknown	—	—	unknown
980	9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe	POST	200	185.172.128.23:80	http://185.172.128.23/f993692117a3fda2.php	unknown	—	—	unknown
4184	WerFault.exe	GET	200	23.200.213.221:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	unknown
5388	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D	unknown	—	—	unknown
4464	SIHClient.exe	GET	200	23.200.213.221:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:138	—	—	—	whitelisted
4008	svchost.exe	239.255.255.250:1900	—	—	—	unknown
1924	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6776	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5152	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
980	9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe	185.172.128.23:80	—	OOO Nadym Svyaz Service	RU	unknown
1924	svchost.exe	23.200.213.221:80	www.microsoft.com	AKAMAI-AS	FR	unknown
4184	WerFault.exe	20.189.173.21:443	watson.events.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	unknown
4184	WerFault.exe	23.200.213.221:80	www.microsoft.com	AKAMAI-AS	FR	unknown
3196	svchost.exe	40.113.103.199:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 4.231.128.59	whitelisted
www.microsoft.com	23.200.213.221 23.36.165.138	whitelisted
watson.events.data.microsoft.com	20.189.173.21	whitelisted
client.wns.windows.com	40.113.103.199	whitelisted
login.live.com	20.190.160.22 20.190.160.14 40.126.32.76 40.126.32.133 40.126.32.134 40.126.32.140 20.190.160.20 40.126.32.72	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
slscr.update.microsoft.com	13.85.23.86	whitelisted
fe3cr.delivery.mp.microsoft.com	13.95.31.18	whitelisted
nexusrules.officeapps.live.com	52.111.227.14	whitelisted
www.bing.com	2.19.176.59 2.19.176.25 2.19.176.73 2.19.176.19 2.19.176.48 2.19.176.66	whitelisted

Threats

PID	Process	Class	Message
—	—	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 32
—	—	Malware Command and Control Activity Detected	STEALER [ANY.RUN] Stealc
—	—	Malware Command and Control Activity Detected	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Add for printing

No debug info

General Info

9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4.exe

ECA5C416B7B17D0308AECD5EE460884E

E4FD9437D9157D4817A3398D8B7321DFF3C394E1

9D5903667AD215AC4EFB3346C2179AC6BF5CA7FA3A9EFCB6CEEC6C53421434B4

12288:OjrIecsqIUvWcuCcvltQJ/5uTpY8ysdyVVVVV:0hqIMUA5uTpY8ys

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

Connects to the CnC server

STEALC has been detected (SURICATA)

SUSPICIOUS

Executes application which crashes

Reads security settings of Internet Explorer

Windows Defender mutex has been found

INFO

Checks proxy server information

Reads the computer name

Checks supported languages

Reads the software policy settings

Creates files or folders in the user directory

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings