Overview

overview

10

Static

static

3

51cba9b4ae...43.exe

windows7-x64

3

51cba9b4ae...43.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-05-2024 01:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    51cba9b4aefefaf72a791e1929f98553f50d643a22179a6aaac9d13f45ea8b43.exe

  • Size

    355KB

  • MD5

    22152460b13e4c2473dc3fcdea192933

  • SHA1

    48ce4a69302e860cd905cd02a10aac942f09d9f3

  • SHA256

    51cba9b4aefefaf72a791e1929f98553f50d643a22179a6aaac9d13f45ea8b43

  • SHA512

    1dbcc6f21c9adfc4f28434cffac8c00fb251e3fbf574a69345792837989f74bfc74a67462e7c4f71333a07caf90e0f3e6c51daf0b2640bae3e06af14c8855104

  • SSDEEP

    6144:KnRqyzZ8VqCaMx3CkcY7FGCdGr0gx1POGIAYanWdHBSxz27XrvnksFwemJ:6RqyzZ2IOGCgfPOGI2nWdhSzUbkReG

Score
10/10
stealcvidardiscoveryspywarestealer

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199689717899

https://t.me/copterwin
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0

Signatures

  • Detect Vidar Stealer 11 IoCs
    stealer
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Detect binaries embedding considerable number of MFA browser extension IDs. 8 IoCs
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 8 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 11 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 8 IoCs
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 11 IoCs
  • Detects executables containing potential Windows Defender anti-emulation checks 11 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 1 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51cba9b4aefefaf72a791e1929f98553f50d643a22179a6aaac9d13f45ea8b43.exe
    "C:\Users\Admin\AppData\Local\Temp\51cba9b4aefefaf72a791e1929f98553f50d643a22179a6aaac9d13f45ea8b43.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:3600
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
          PID:4428
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
          • Checks computer location settings
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2800
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BGDHDAFIDGDB" & exit
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4324
            • C:\Windows\SysWOW64\timeout.exe
              timeout /t 10
              4⤵
              • Delays execution with timeout.exe
              PID:3600
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3504 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:3
        1⤵
          PID:4632
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3776 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:4972

          Network

          MITRE ATT&CK Matrix ATT&CK v13

          Initial Access

          Execution

          Persistence

          Privilege Escalation

          Defense Evasion

          Credential Access

          Unsecured Credentials

          4
          T1552

          Credentials In Files

          4
          T1552.001

          Discovery

          Query Registry

          3
          T1012

          System Information Discovery

          3
          T1082

          Lateral Movement

          Collection

          Data from Local System

          4
          T1005

          Exfiltration

          Command and Control

          Impact

          Resource Development

          Reconnaissance

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
            Filesize

            2B

            MD5

            d751713988987e9331980363e24189ce

            SHA1

            97d170e1550eee4afc0af065b78cda302a97674c

            SHA256

            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

            SHA512

            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

            Download Submit
          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
            Filesize

            40B

            MD5

            20d4b8fa017a12a108c87f540836e250

            SHA1

            1ac617fac131262b6d3ce1f52f5907e31d5f6f00

            SHA256

            6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

            SHA512

            507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

            Download Submit
          • memory/1348-1-0x0000000000BE0000-0x0000000000BE1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1348-3-0x0000000000BE0000-0x0000000000BE1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1348-0-0x0000000000BE0000-0x0000000000BE1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/2800-5-0x0000000000400000-0x0000000000646000-memory.dmp
            Filesize

            2.3MB

            Download
          • memory/2800-11-0x0000000000400000-0x0000000000646000-memory.dmp
            Filesize

            2.3MB

            Download
          • memory/2800-12-0x0000000000400000-0x0000000000646000-memory.dmp
            Filesize

            2.3MB

            Download
          • memory/2800-14-0x000000001B550000-0x000000001B7AF000-memory.dmp
            Filesize

            2.4MB

            Download
          • memory/2800-29-0x0000000000400000-0x0000000000646000-memory.dmp
            Filesize

            2.3MB

            Download
          • memory/2800-30-0x0000000000400000-0x0000000000646000-memory.dmp
            Filesize

            2.3MB

            Download
          • memory/2800-46-0x0000000000400000-0x0000000000646000-memory.dmp
            Filesize

            2.3MB

            Download
          • memory/2800-7-0x0000000000400000-0x0000000000646000-memory.dmp
            Filesize

            2.3MB

            Download
          • memory/2800-53-0x0000000000400000-0x0000000000646000-memory.dmp
            Filesize

            2.3MB

            Download
          • memory/2800-67-0x0000000000400000-0x0000000000646000-memory.dmp
            Filesize

            2.3MB

            Download
          • memory/2800-68-0x0000000000400000-0x0000000000646000-memory.dmp
            Filesize

            2.3MB

            Download
          • memory/2800-2-0x0000000000400000-0x0000000000646000-memory.dmp
            Filesize

            2.3MB

            Download