Analysis
-
max time kernel
145s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
11-10-2023 20:53
General
-
Target
VegaStealer_v1.exe
-
Size
6.7MB
-
MD5
41b8caca7e2c1ec36c2528fcd6a3f334
-
SHA1
45ef2451a4916cf5c88e90eb1e4360f04ba3549e
-
SHA256
c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16
-
SHA512
f160616571478eb55fb6a61c94961c7c47b0db56f03638918641fdfbc505e929921b88a9059d44554edee6e6a1c4e73127c0db0fe9df0df8d69ac73f9fa4599f
-
SSDEEP
196608:Rrp3ECTkyi+4l72FW1aq3BzV+gSYyPO6GEkhQAp6UFj4:VHw/lqFWYq3lV+gSYyP3GEkmJ
Malware Config
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VegaStealer_v1.exe"C:\Users\Admin\AppData\Local\Temp\VegaStealer_v1.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v1.exe"C:\Users\Admin\AppData\Local\Temp\v1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5a73fdfb6815b151848257eca042a42ef
SHA173f18e6b4d1f638e7ce2a7ad36635018482f2c55
SHA25610c9ccec863ed80850c7b7080e4f2e34b133ce259d1ae3ea7a305cebf6e2940d
SHA512111f5a7bd916ab317fc127cbf49a2a81c2a614ce3a655a0446f2ebf3c2e61509db5633a391bef06c4ba0b58a71c752262ec2467a09abc56827263c647b08a09d
-
Filesize
1.7MB
MD5a73fdfb6815b151848257eca042a42ef
SHA173f18e6b4d1f638e7ce2a7ad36635018482f2c55
SHA25610c9ccec863ed80850c7b7080e4f2e34b133ce259d1ae3ea7a305cebf6e2940d
SHA512111f5a7bd916ab317fc127cbf49a2a81c2a614ce3a655a0446f2ebf3c2e61509db5633a391bef06c4ba0b58a71c752262ec2467a09abc56827263c647b08a09d
-
Filesize
4.6MB
MD5eb7f803cbace4fbc19716180481fbbe1
SHA19525001f6f88209d76baeba2eaf7a4d9325240dd
SHA256bc79161f2093625fe17b17337979ccfdcedd18ff473ec008999f21f2b77bb081
SHA5124d9cac839c2cacbfe3ff9c6a74ce22b2a68e8929dd3d89982dd6ea4640dad0e3215c6291cd0734b87c29ddf6880f8efec0bce43eb701492c6c2fe42dd0fdc886
-
Filesize
4.6MB
MD5eb7f803cbace4fbc19716180481fbbe1
SHA19525001f6f88209d76baeba2eaf7a4d9325240dd
SHA256bc79161f2093625fe17b17337979ccfdcedd18ff473ec008999f21f2b77bb081
SHA5124d9cac839c2cacbfe3ff9c6a74ce22b2a68e8929dd3d89982dd6ea4640dad0e3215c6291cd0734b87c29ddf6880f8efec0bce43eb701492c6c2fe42dd0fdc886
-
Filesize
4.6MB
MD5eb7f803cbace4fbc19716180481fbbe1
SHA19525001f6f88209d76baeba2eaf7a4d9325240dd
SHA256bc79161f2093625fe17b17337979ccfdcedd18ff473ec008999f21f2b77bb081
SHA5124d9cac839c2cacbfe3ff9c6a74ce22b2a68e8929dd3d89982dd6ea4640dad0e3215c6291cd0734b87c29ddf6880f8efec0bce43eb701492c6c2fe42dd0fdc886
-
Filesize
1KB
MD539e28d577f60e82b7f808a1476f23ac4
SHA12dc6b0fe3f86daca3866e81486b8cdc54a8a3e00
SHA2562accce97f1bd003fbdbfb66cc634eb6a76f2bded1961fe96322a6f8f71aae00d
SHA512c29a65ea2e2ae4a9c92e1d5b34e24086b9850e588889a197bbc3f80f3582cf182eaa1df0b32fe74d182070f7ba2f81f5ffa20d1c386ec221072b0ef432ca4e4e
-
Filesize
1KB
MD539e28d577f60e82b7f808a1476f23ac4
SHA12dc6b0fe3f86daca3866e81486b8cdc54a8a3e00
SHA2562accce97f1bd003fbdbfb66cc634eb6a76f2bded1961fe96322a6f8f71aae00d
SHA512c29a65ea2e2ae4a9c92e1d5b34e24086b9850e588889a197bbc3f80f3582cf182eaa1df0b32fe74d182070f7ba2f81f5ffa20d1c386ec221072b0ef432ca4e4e
-
Filesize
230B
MD59e7f1384892de4b4c71d630b5413e832
SHA129cf10ae7b72193462436f188d75f575fb9869f2
SHA256c71e94fb1c8e53aca3ddd38e2df2eb37cde2a4a7d021425dbcd69872b0a280e7
SHA51281b3c85d572a32c03a3050327cc7bb95cb7f9a6135d6dd00a0b6e0eb555663b7b0022778137fb336e99205f2ab5d45fd19168caa64ffdc1e5fd355acc593a369
-
Filesize
1KB
MD539e28d577f60e82b7f808a1476f23ac4
SHA12dc6b0fe3f86daca3866e81486b8cdc54a8a3e00
SHA2562accce97f1bd003fbdbfb66cc634eb6a76f2bded1961fe96322a6f8f71aae00d
SHA512c29a65ea2e2ae4a9c92e1d5b34e24086b9850e588889a197bbc3f80f3582cf182eaa1df0b32fe74d182070f7ba2f81f5ffa20d1c386ec221072b0ef432ca4e4e
-
Filesize
408KB
-
Filesize
152KB
-
Filesize
104KB
-
Filesize
120KB
-
Filesize
320KB
-
Filesize
3.2MB
-
Filesize
136KB
-
Filesize
472KB
-
Filesize
232KB
-
Filesize
360KB
-
Filesize
1.8MB
-
Filesize
64KB
-
Filesize
712KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
4.6MB
-
Filesize
10.8MB