stealc | 46b8ec4f65622595233743e8277a2980f69f866e6edd3a2ec610d0f2872a1e5f

Analysis

max time kernel
1194s
max time network
1205s
platform
windows10-2004_x64
resource
win10v2004-20240508-es
resource tags

arch:x64arch:x86image:win10v2004-20240508-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
08/05/2024, 15:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
46b8ec4f65622595233743e8277a2980f69f866e6edd3a2ec610d0f2872a1e5f.exe
Size 765KB
Sample240508-s7x2qaec63
SHA256 46b8ec4f65622595233743e8277a2980f69f866e6edd3a2ec610d0f2872a1e5f
MD5 4efb38b934e4247c49ac1de662b4fe2c
SHA1 121fe04be542a55b4ce6716d792e9ce4e8a5c0ae
SHA512 8ced1adc480693b2d5daf4013317118c2794c8840d617aa4e30a50fa0b1d8ab5aa3bb2bb2b241c672debb477ee756afcda48e9dc163a5cbb362a5d95f73c50ed
SSDEEP 12288:AXyWGSXbu0jblSgRI4/8Xg/38hMK6JZB2L7IflVlkKWm9A/Hu5ya/8p/ryr:AXyubu0jbIg8Q8t0yElkKWUGHu5yYoyr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc vidar stealer

Malware Config

Signatures

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/1832-30-0x0000000003700000-0x0000000003943000-memory.dmp	family_vidar_v7
behavioral2/memory/1832-31-0x0000000003700000-0x0000000003943000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	46b8ec4f65622595233743e8277a2980f69f866e6edd3a2ec610d0f2872a1e5f.exe

Executes dropped EXE 1 IoCs

pid	Process
1832	Holdem.pif

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2240	1832	WerFault.exe	100
4556	1832	WerFault.exe	100

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
3656	tasklist.exe
2080	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2908	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1832	Holdem.pif
1832	Holdem.pif
1832	Holdem.pif
1832	Holdem.pif
1832	Holdem.pif
1832	Holdem.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3656	tasklist.exe
Token: SeDebugPrivilege	2080	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1832	Holdem.pif
1832	Holdem.pif
1832	Holdem.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1832	Holdem.pif
1832	Holdem.pif
1832	Holdem.pif

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 836	1664	46b8ec4f65622595233743e8277a2980f69f866e6edd3a2ec610d0f2872a1e5f.exe	88
PID 1664 wrote to memory of 836	1664	46b8ec4f65622595233743e8277a2980f69f866e6edd3a2ec610d0f2872a1e5f.exe	88
PID 1664 wrote to memory of 836	1664	46b8ec4f65622595233743e8277a2980f69f866e6edd3a2ec610d0f2872a1e5f.exe	88
PID 836 wrote to memory of 3656	836	cmd.exe	92
PID 836 wrote to memory of 3656	836	cmd.exe	92
PID 836 wrote to memory of 3656	836	cmd.exe	92
PID 836 wrote to memory of 2516	836	cmd.exe	93
PID 836 wrote to memory of 2516	836	cmd.exe	93
PID 836 wrote to memory of 2516	836	cmd.exe	93
PID 836 wrote to memory of 2080	836	cmd.exe	95
PID 836 wrote to memory of 2080	836	cmd.exe	95
PID 836 wrote to memory of 2080	836	cmd.exe	95
PID 836 wrote to memory of 1568	836	cmd.exe	96
PID 836 wrote to memory of 1568	836	cmd.exe	96
PID 836 wrote to memory of 1568	836	cmd.exe	96
PID 836 wrote to memory of 776	836	cmd.exe	97
PID 836 wrote to memory of 776	836	cmd.exe	97
PID 836 wrote to memory of 776	836	cmd.exe	97
PID 836 wrote to memory of 3624	836	cmd.exe	98
PID 836 wrote to memory of 3624	836	cmd.exe	98
PID 836 wrote to memory of 3624	836	cmd.exe	98
PID 836 wrote to memory of 4784	836	cmd.exe	99
PID 836 wrote to memory of 4784	836	cmd.exe	99
PID 836 wrote to memory of 4784	836	cmd.exe	99
PID 836 wrote to memory of 1832	836	cmd.exe	100
PID 836 wrote to memory of 1832	836	cmd.exe	100
PID 836 wrote to memory of 1832	836	cmd.exe	100
PID 836 wrote to memory of 2908	836	cmd.exe	101
PID 836 wrote to memory of 2908	836	cmd.exe	101
PID 836 wrote to memory of 2908	836	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\46b8ec4f65622595233743e8277a2980f69f866e6edd3a2ec610d0f2872a1e5f.exe
"C:\Users\Admin\AppData\Local\Temp\46b8ec4f65622595233743e8277a2980f69f866e6edd3a2ec610d0f2872a1e5f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k move Classics Classics.cmd & Classics.cmd & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3656
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa.exe opssvc.exe"
    3⤵
    PID:2516
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2080
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
    3⤵
    PID:1568
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 334963
    3⤵
    PID:776
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "BbcAdvisorsAndaleNowhere" Lease
    3⤵
    PID:3624
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b Pharmacy + Experiences + Creating 334963\e
    3⤵
    PID:4784
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\334963\Holdem.pif
    334963\Holdem.pif 334963\e
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1832
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 2392
      4⤵
      Program crash
      PID:2240
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 2400
      4⤵
      Program crash
      PID:4556
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4164,i,15717057251527248109,17644545409502739451,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:8
1⤵
PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 1832 -ip 1832
1⤵
PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1832 -ip 1832
1⤵
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5044,i,15717057251527248109,17644545409502739451,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Holdem.pif

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\334963\Holdem.pif
Size 872KB
SHA256 865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4
MD5 6ee7ddebff0a2b78c7ac30f6e00d1d11
SHA1 f2f57024c7cc3f9ff5f999ee20c4f5c38bfc20a2
SHA512 57d56de2bb882f491e633972003d7c6562ef2758c3731b913ff4d15379ada575062f4de2a48ca6d6d9241852a5b8a007f52792753fd8d8fee85b9a218714efd0
SSDEEP 12288:DpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31troPTdFqgaAV2M0L:DT3E53Myyzl0hMf1te7xaA8M0L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\334963\e
Size 304KB
SHA256 58f7aedbf5b73b0ad71fcfdde89e30bf4f6cf5f1a4aa8edccc7da92a81300235
MD5 6a9a08a897fd2567f2be8a37af9409c7
SHA1 d5905d73d5113bf28e95e387f5a885f2dc4df670
SHA512 841f7bbef006d50e97d7b068a45f11e9f5df7ca75a9c23c7c7b0db2867b13af01c3195a7972ef450c25fb9493cd09d0af4c858df0aceb3397b851134afaa11e3
SSDEEP 6144:umgBywAo0a8WsSp1uOUF2BlfoIiq0xzMDa9PQ/K9mZJ/uBwDLQq0:aTt8Wsg19tHfobq0xqoYJWBeLs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Classics

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Classics
Size 27KB
SHA256 dbb0ab5b95732c6704495df674a66d09b69638f1f6dc96cd4a6b02d98d678224
MD5 8f7f76574b4ea462583d058f32d53442
SHA1 f09d455f80917cffb3afae4dc7918e70f22fa62f
SHA512 5607a45b3197be7f590920247f1701b2631b77af97ced09b28a744306e089527e5e84e95b3f4d3b9e1c48ce1e5440a98034510e4099501a821ad0469cab7d641
SSDEEP 768:JE/QndS3hiWIS+e57WB3hvghsNIfuj1mGBqGBBWYt6:JJdSQ7S+epWLvEkIGxJt6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Creating

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Creating
Size 102KB
SHA256 8145f63ccc2c07ed746db82f8421e629735f6e69a4f605abb5cf1212ede8fcbd
MD5 3174e5c547ec44d9e422845f62e95b6b
SHA1 b02be201156cd93436bfee9b1d8e363b14c51707
SHA512 80134b58fe675194bed7e9f493abcfc804dd596c0c2ef7cb93b81a9fd1cfeb9461bfe6023b25883006a320ae49b341d8a3b0ef7618e994139aa76162cbc3498a
SSDEEP 1536:CPxRRKh5gbmwTTIdDNXVAXZe0+TvwHEkP/ey0FEUruz1GGkO/Uweef2eYSAZoaa0:k/K7cuVVmZJEvEuyKZslMgDLQXa0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Experiences

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Experiences
Size 177KB
SHA256 43a07113368deaf916127480450b1b19c22eed4f367cf73b20b6bf6685d014dd
MD5 0131a04280608465ef6a189301961fce
SHA1 3e0a81f593cbe518c96d675917922f3a1d20309d
SHA512 039ab3fcf9daabeed49ce654f43cb5a7ad3cb51dcfb2293c3c028c5df4da29f9d2491dd69594f7f3a6c9c45106fe5240f16d5f7aa68cf19993333606bf7bdfc8
SSDEEP 3072:IzAfkCB1op89a8YnYH7f+PpHVufdUULRuTBlfEVpmiqlqkEfA+MTf8rz5UfLqL:4Ao0a8WsSp1uOUF2BlfoIiq0xzMDa9PL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lease

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Lease
Size 123B
SHA256 c0d3b1dbbbf02073b0e60d6ca6294c97134d13017e6332d1ee49918a4ff94a1b
MD5 98e87874165393607b54818ea0cc0813
SHA1 dddedd925a309cb2b359eb08e678f4829ee26632
SHA512 127c1f7978f6c8cf321b62b5f45766a81807cec5f778231950ca3362201ceeb914d6a84d97d1f57ff14aa34ba12c83e29b1a51b564649d0754e692eba2dd7f8a
MD5 SHA1 SHA512

Submit Download

Oil

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Oil
Size 216KB
SHA256 c1e5f515f73058a6a4ab02c95b7111001a10f933f51542258b97a53a3e56b354
MD5 ccff4d45b31b96ad3bfdaee364b88c66
SHA1 8594f9fcd10c3ba98529175eeeb7f00b17f17f17
SHA512 dc18caaeea264da603ba77c4878f260f84ac60908d41360d3db131687c210c67af22e77675c9ecf0c253f59386d8d0be6caeaa0c80d88bbade7445939e54591c
SSDEEP 6144:5/12vk6AQzyMfA+eyVPlcBgtoTqnvAfcaGM:5/hMyyzlcqikvAfcNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pharmacy

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Pharmacy
Size 25KB
SHA256 eb99bfa316742ed21fa831b87deade8dbcd28337c6ddc77682a3e93f97b2f47e
MD5 a47f571ca70ad97d1ea1435f098a3e6c
SHA1 da0f173dbf68004bf0b101a7f1b044144f707c52
SHA512 eab604201412f6440cd091adf83a1e85c98ba712e61b037107a70d49d4bebf7d60f4cd375009f8e3f1671a2d7adf17757a04f4b6b58b401e142ac3f73bce0858
SSDEEP 768:NPteSp4vUNy+Cy73dv6tamehP+JkMtXCU9y:uvyt73V6A9+JkcyU9y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Relatives

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Relatives
Size 250KB
SHA256 421e5fcf6246faae145237daa2a0542e7a45aea01be75c5070770de93cb1644f
MD5 cd818ee7f8bd1f1bae4e1822c4e41541
SHA1 5cc00d959325f119b026ed0e330d57fdfee543a2
SHA512 87c34f4ad54b139dd4312c598e155a534aafe2f408d20c13805764cb1d4ab641e300a6145e4ca2e2919d883c89600e567df377c9c9a52ddd7438a6a1fcc66794
SSDEEP 3072:CDqeb2Xo2IkVvh8p65Nu+dVtqi/x4Rqf21Rgat0g/bZaUAg0FuPOKBNEBNUGXEyc:8b2M8JTDD/xcq21R1p/rAOPOei7TdFU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Returned

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Returned
Size 43KB
SHA256 b27657c27b957b8794ec2a6644d75578a620a0ec413e1be8b961d0152e12bc48
MD5 f791d2356005e6538629b3bde88b0bdc
SHA1 ec5eecb9515dda66cec06d81b2595906e5454a1a
SHA512 0be50d77ea1920052734bcc7319dece0c4a741556be621bf41b7cac88c03497c8ade3df1582cdfc479aae48278fb9dcc28ec1cf619abe1f8f12175586229136a
SSDEEP 768:09BSCVoyO15DuOKHnrxbxZiUCu2iPaLTQ7Q1tCwqVLwQVn8qT4O:09BBVgCOa1ZBPaPQaEwo0yv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Rolled

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Rolled
Size 226KB
SHA256 95dd465fa97618639d0d11556dbaa8a5f50484ada6cf46d82b6b832cc6c2e81d
MD5 0fa84a1591ef7ed70fb17e1701ce0e8c
SHA1 3e2e21e13f1cdfa6684063ba1150251b5b2afb0d
SHA512 ffa3c5f8ef264cffe1552cfd7a0bf5775e308b3392bd7e175580ea3c66fd7b508ee9d8fde9feba1708172bf33b36e2af8d5952e81b66713d7a513c3fc53e262c
SSDEEP 3072:GCV26MqgQTc5F446iYNpK5SB7BJBzLZDKJtIs8di/37EM/j2xQeixW:Gi2VWTyFsJ8gNJBnGtINsegW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Supervision

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Supervision
Size 137KB
SHA256 b4873b854cd42b8e5cf792c368043bb24427045fc41b22c6ae977cc342cec1cf
MD5 9f30e95a4b07c6de10cbd2361b682751
SHA1 d01cd024a1ac849e97a5217368ac6c1eb4fe6cdd
SHA512 a0249a4106cbe0c087906adb6402b5ad5a536b83676d5af10258b76a0e64935a3483a988dfa0fc221daa681e815d2b118a2f094bdbd4e7426b785ba0da116a90
SSDEEP 1536:K+l6JPTcUNx6/xhgariwYLTN3EfrDWyu0uZo2x:n6i/xhgariwYLTNaWy4ZNx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1832-27-0x0000000003700000-0x0000000003943000-memory.dmp

Download

memory/1832-28-0x0000000003700000-0x0000000003943000-memory.dmp

Download

memory/1832-29-0x0000000003700000-0x0000000003943000-memory.dmp

Download

memory/1832-30-0x0000000003700000-0x0000000003943000-memory.dmp

Download

memory/1832-31-0x0000000003700000-0x0000000003943000-memory.dmp

Download