stealc | 45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a.exe
Size

147.8MB
MD5

7ed20e00327c9c34d9d2d4419a933fe1
SHA1

6e05b701929d46678188bf26b2fce7257327c90f
SHA256

45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a
SHA512

6fd0a0148f919a15b0b0c9e88820185c833f256a272373d659f54d3813b530b4ba3fc4bda979bae1797f59f3920cf36c44001fdcc3731f7c78d8140638d3b29e
SSDEEP

786432:adyRHF1WRkXOzGbY55kQshmSBaNf6rhoiu6wyiz23ku4Z8GG:adyxTWRkXGGE55XArKiu/yOlhG

Score

10^/10

stealc vidar stealer

Malware Config

Signatures

Detect Vidar Stealer 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2480-80-0x0000000000060000-0x0000000000092000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a.exe

description	pid	process	target process
PID 2168 wrote to memory of 2480	2168	45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a.exe	cmd.exe
PID 2168 wrote to memory of 2480	2168	45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a.exe	cmd.exe
PID 2168 wrote to memory of 2480	2168	45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a.exe	cmd.exe
PID 2168 wrote to memory of 2480	2168	45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a.exe
"C:\Users\Admin\AppData\Local\Temp\45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168

C:\Windows\system32\cmd.exe
"cmd.exe"
2⤵
PID:2480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-1-0x00000001402B7000-0x00000001402B9000-memory.dmp

Filesize
8KB

Download
memory/2168-0-0x0000000003480000-0x0000000004110000-memory.dmp

Filesize
12.6MB

Download
memory/2168-6-0x00000000058A0000-0x0000000006590000-memory.dmp

Filesize
12.9MB

Download
memory/2168-21-0x0000000001F30000-0x0000000001F50000-memory.dmp

Filesize
128KB

Download
memory/2168-17-0x0000000001D60000-0x0000000001D80000-memory.dmp

Filesize
128KB

Download
memory/2168-13-0x0000000006870000-0x0000000006B50000-memory.dmp

Filesize
2.9MB

Download
memory/2168-9-0x0000000001D10000-0x0000000001D30000-memory.dmp

Filesize
128KB

Download
memory/2168-29-0x0000000002120000-0x0000000002140000-memory.dmp

Filesize
128KB

Download
memory/2168-25-0x0000000001F70000-0x0000000001F90000-memory.dmp

Filesize
128KB

Download
memory/2168-36-0x0000000002170000-0x00000000021A0000-memory.dmp

Filesize
192KB

Download
memory/2168-44-0x00000000048C0000-0x0000000004A40000-memory.dmp

Filesize
1.5MB

Download
memory/2168-48-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/2168-40-0x0000000002570000-0x00000000025B0000-memory.dmp

Filesize
256KB

Download
memory/2168-53-0x0000000002640000-0x0000000002660000-memory.dmp

Filesize
128KB

Download
memory/2168-56-0x0000000004A40000-0x0000000004A70000-memory.dmp

Filesize
192KB

Download
memory/2168-64-0x0000000006C50000-0x0000000006CA0000-memory.dmp

Filesize
320KB

Download
memory/2168-60-0x0000000004A70000-0x0000000004A90000-memory.dmp

Filesize
128KB

Download
memory/2480-80-0x0000000000060000-0x0000000000092000-memory.dmp

Filesize
200KB

Download