stealc | 74375fb2d74b7174b1444727d6bd1534918dce2deffdf037cfc3050c20679d83

Analysis

max time kernel
137s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

409KB
MD5

5e32f62d26b4476c6862785b9d6b5db3
SHA1

8fc02bcd0def2535b64690e5a5ad4932bc92a398
SHA256

74375fb2d74b7174b1444727d6bd1534918dce2deffdf037cfc3050c20679d83
SHA512

52a24032e70c00461694e271cd4bbacf0353a4a2c6a8fed15def4fe1fe4f9792dea10a3a4cc9f7c72a0e9e4280220d7ae362fce33703885a1d417979d75f395c
SSDEEP

6144:D0EpI60nbM8uPZy3+8KID4LunuX2Csvo0ZtPZ4mr99uXDgXyXHS:4E+60nbnuPL5X2NVrZhrz8HS

Score

10^/10

stealc vidar 3c43beec65deb206d81f3c6b8d956f18 stealer

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

Version

9.5

Botnet

3c43beec65deb206d81f3c6b8d956f18

https://steamcommunity.com/profiles/76561199681720597

https://t.me/talmatin

Attributes

profile_id_v2
3c43beec65deb206d81f3c6b8d956f18
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 OPR/101.0.0.0

Signatures

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/memory/2472-0-0x0000000000400000-0x0000000000647000-memory.dmp	family_vidar_v7
behavioral2/memory/2472-4-0x0000000000400000-0x0000000000647000-memory.dmp	family_vidar_v7
behavioral2/memory/2472-5-0x0000000000400000-0x0000000000647000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1000 set thread context of 2472	1000	file.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5516	2472	WerFault.exe	88

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 1740	1000	file.exe	87
PID 1000 wrote to memory of 1740	1000	file.exe	87
PID 1000 wrote to memory of 1740	1000	file.exe	87
PID 1000 wrote to memory of 2472	1000	file.exe	88
PID 1000 wrote to memory of 2472	1000	file.exe	88
PID 1000 wrote to memory of 2472	1000	file.exe	88
PID 1000 wrote to memory of 2472	1000	file.exe	88
PID 1000 wrote to memory of 2472	1000	file.exe	88
PID 1000 wrote to memory of 2472	1000	file.exe	88
PID 1000 wrote to memory of 2472	1000	file.exe	88
PID 1000 wrote to memory of 2472	1000	file.exe	88
PID 1000 wrote to memory of 2472	1000	file.exe	88

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1740
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 2236
    3⤵
    - Program crash
    PID:5516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2472 -ip 2472
1⤵
PID:1608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1000-1-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/2472-0-0x0000000000400000-0x0000000000647000-memory.dmp

Filesize
2.3MB

Download
memory/2472-4-0x0000000000400000-0x0000000000647000-memory.dmp

Filesize
2.3MB

Download
memory/2472-5-0x0000000000400000-0x0000000000647000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads