stealc | 09ad84f8dde519aa02e92ffce896f55271105ceaab7e0f0a1f1ca9fee90650ff

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-05-2024 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

377KB
MD5

1a6b4d357d1b8bab80524e40be1b2698
SHA1

70961ace92a0ebfdb38ae27a22181fb5a4f7d440
SHA256

09ad84f8dde519aa02e92ffce896f55271105ceaab7e0f0a1f1ca9fee90650ff
SHA512

67484dcb04fc15b09b88679fd3ac860991cebe97c07a27bf9e425e8277def7f61d244690ee582c2be72d0dda3fa486b53382f3e3ad368602d176c5f72a77de67
SSDEEP

6144:NqW5NIK5m09C0h5t4mnNpZO+Ua2PsQxDnK6gDelK88JqeGq0DLt+7SHo:8W5NIYF4mnZO+Ua2zxDnKrZJqtHLt+mI

Score

10^/10

stealc vidar 03cea2609023d13f145ac6c5dc897112 stealer

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

Version

9.3

Botnet

03cea2609023d13f145ac6c5dc897112

https://steamcommunity.com/profiles/76561199680449169

https://t.me/r1g1o

Attributes

profile_id_v2
03cea2609023d13f145ac6c5dc897112
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 OPR/101.0.0.0

Signatures

Detect Vidar Stealer 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/1584-1-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/1584-3-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/1584-5-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 4300 set thread context of 1584 4300 file.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4060 1584 WerFault.exe RegAsm.exe

description	pid	process	target process
PID 4300 set thread context of 1584	4300	file.exe	RegAsm.exe

pid	pid_target	process	target process
4060	1584	WerFault.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

file.exe

description	pid	process	target process
PID 4300 wrote to memory of 1584	4300	file.exe	RegAsm.exe
PID 4300 wrote to memory of 1584	4300	file.exe	RegAsm.exe
PID 4300 wrote to memory of 1584	4300	file.exe	RegAsm.exe
PID 4300 wrote to memory of 1584	4300	file.exe	RegAsm.exe
PID 4300 wrote to memory of 1584	4300	file.exe	RegAsm.exe
PID 4300 wrote to memory of 1584	4300	file.exe	RegAsm.exe
PID 4300 wrote to memory of 1584	4300	file.exe	RegAsm.exe
PID 4300 wrote to memory of 1584	4300	file.exe	RegAsm.exe
PID 4300 wrote to memory of 1584	4300	file.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4300

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 2236
3⤵
- Program crash
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1584 -ip 1584
1⤵
PID:3340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1584-1-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1584-3-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1584-5-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/4300-0-0x00000000009FE000-0x0000000000A00000-memory.dmp

Filesize
8KB

Download