stealc | 48a6d2eb28127d8bc1623400f0b33ea5f51a7473ce3369a14e8b4a5f0d02bca4

Analysis

max time kernel
129s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2024 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

432KB
MD5

7fff271b63f7af3a9a59f068a6f8955f
SHA1

67c0082192328a5c003efe6fd87e38802b95570d
SHA256

48a6d2eb28127d8bc1623400f0b33ea5f51a7473ce3369a14e8b4a5f0d02bca4
SHA512

55c0a315476321ea11f9696fd3642cc3bd560ce5321d3c0c0f2b6913fce11ee3d4472fef0c8ff9bdd0972ea549d5d5932a92124351cd4f3fce5524d7eb8a2346
SSDEEP

6144:K5/FIlRSG9VJogxAJmVku6fpAgb+K0iudeI9Iaf3PMFViAnHo:w/FIbxAkV1gb7ZuwIaafP0Ho

Score

10^/10

stealc vidar 03cea2609023d13f145ac6c5dc897112 stealer

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

Version

9.3

Botnet

03cea2609023d13f145ac6c5dc897112

https://steamcommunity.com/profiles/76561199680449169

https://t.me/r1g1o

Attributes

profile_id_v2
03cea2609023d13f145ac6c5dc897112
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 OPR/101.0.0.0

Signatures

Detect Vidar Stealer 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/1824-1-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/2012-2-0x0000000000EF0000-0x0000000000F52FAE-memory.dmp	family_vidar_v7
behavioral2/memory/1824-6-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/1824-5-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 2012 set thread context of 1824 2012 file.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3520 1824 WerFault.exe RegAsm.exe

description	pid	process	target process
PID 2012 set thread context of 1824	2012	file.exe	RegAsm.exe

pid	pid_target	process	target process
3520	1824	WerFault.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

file.exe

description	pid	process	target process
PID 2012 wrote to memory of 1824	2012	file.exe	RegAsm.exe
PID 2012 wrote to memory of 1824	2012	file.exe	RegAsm.exe
PID 2012 wrote to memory of 1824	2012	file.exe	RegAsm.exe
PID 2012 wrote to memory of 1824	2012	file.exe	RegAsm.exe
PID 2012 wrote to memory of 1824	2012	file.exe	RegAsm.exe
PID 2012 wrote to memory of 1824	2012	file.exe	RegAsm.exe
PID 2012 wrote to memory of 1824	2012	file.exe	RegAsm.exe
PID 2012 wrote to memory of 1824	2012	file.exe	RegAsm.exe
PID 2012 wrote to memory of 1824	2012	file.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 2192
3⤵
- Program crash
PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1824 -ip 1824
1⤵
PID:3468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-1-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1824-6-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1824-5-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2012-0-0x0000000000F4E000-0x0000000000F50000-memory.dmp

Filesize
8KB

Download
memory/2012-2-0x0000000000EF0000-0x0000000000F52FAE-memory.dmp

Filesize
395KB

Download