stealc | 3a0daf8770924f4f9f75a66faf1237e239c83fc96d9c87b1b0dd051ddd612a78

General

Target
46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe
Size 9.9MB
Sample240604-c5yx8sbb67
SHA256 46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb
MD5 711e1fcfc587eee41a187abd9091bfea
SHA1 cb1e234580935af2f597d9e667f8d2599368abe3
SHA512 bb0f540acf5e0e9f5044e3c2868f8aec88199ae5e9007a6df2a904a60b33079cd4d94e66ff195b898c6fe0d91075fb77a789a5e64769b6b4cba81232dc91fdb5
SSDEEP 196608:tYohctfEFaaf+vApItM1rf/c3y+OykakmBaREv12zsE1EyamEVgwNzYtdeu8T:tYictfEFv+vHC1b/cXcyGE92h1om3oYS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc vidar discovery spyware stealer

Malware Config

Signatures

Detect Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/4900-33-0x0000000000720000-0x000000000075B000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Windows.exe

Executes dropped EXE 2 IoCs

pid	Process
4372	46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe
4900	Windows.exe

Loads dropped DLL 1 IoCs

pid	Process
4372	46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Windows.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4240	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4900	Windows.exe
4900	Windows.exe
4900	Windows.exe
4900	Windows.exe
4900	Windows.exe
4900	Windows.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 4372	1172	46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe	83
PID 1172 wrote to memory of 4372	1172	46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe	83
PID 1172 wrote to memory of 4372	1172	46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe	83
PID 4372 wrote to memory of 4900	4372	46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe	99
PID 4372 wrote to memory of 4900	4372	46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe	99
PID 4372 wrote to memory of 4900	4372	46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe	99
PID 4900 wrote to memory of 4548	4900	Windows.exe	101
PID 4900 wrote to memory of 4548	4900	Windows.exe	101
PID 4900 wrote to memory of 4548	4900	Windows.exe	101
PID 4548 wrote to memory of 4240	4548	cmd.exe	103
PID 4548 wrote to memory of 4240	4548	cmd.exe	103
PID 4548 wrote to memory of 4240	4548	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe
"C:\Users\Admin\AppData\Local\Temp\46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\TEMP\{17ABA65A-7D4D-49A8-A4BC-61F838EB9ED5}\.cr\46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe
  "C:\Windows\TEMP\{17ABA65A-7D4D-49A8-A4BC-61F838EB9ED5}\.cr\46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe" -burn.filehandle.attached=656 -burn.filehandle.self=652
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\TEMP\{002679E3-044F-487A-BA5D-A523CDC6F9DA}\.ba\Windows.exe
    "C:\Windows\TEMP\{002679E3-044F-487A-BA5D-A523CDC6F9DA}\.ba\Windows.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HIIEBAFCBKFI" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4548
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:4240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Windows.exe

Path C:\Windows\Temp\{002679E3-044F-487A-BA5D-A523CDC6F9DA}\.ba\Windows.exe
Size 8.1MB
SHA256 c229104ef06ac38a99c5e6ce7123a2959ec6b8ad8a2d9135d15b5239bf8b1258
MD5 eded76c95a6105d265c1e727ca94fc23
SHA1 c74dbc50171783e9f6d84e429ca976241400fcca
SHA512 4838f41c029752f1b7436bbcbe2597c1ec6dc731bee53fa1d89d8d4edc6af505a6b894574a637029f3562edb613affb925e0a7a64f709bad21fc1c4017089663
SSDEEP 196608:5ech9CzJqXM32jyXOKtych9CzJqXM32jyX0Ktych9CzJqXM32jyX8:xh9C8Q2mXOKNh9C8Q2mX0KNh9C8Q2mX8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Yolk.dll

Path C:\Windows\Temp\{002679E3-044F-487A-BA5D-A523CDC6F9DA}\.ba\Yolk.dll
Size 2.9MB
SHA256 9728b48821b9d18b1e4ffab96dafc1fe9d2fba2dc7464ecbbf5f3f83524bed96
MD5 24806171a0ed58f6c1c528f003ce39ef
SHA1 39fb9886c7928e597e40b43c2a9d2bbc35eb449a
SHA512 84531b371b6f6510a112d78bd36e6298048b20bed32ed8a2dbc2aa7c75e3c0faf35602ec15caada2598c1cc8ca6cf2bde64fd584479c634c8dd93bddb261ad70
SSDEEP 24576:ND+KeZgz3YDZ3YOyZkRV3wE78Kcuotn+ye7hpdiuXwPKO6O/OUOYO1Od6jrr2Kyi:Na90GRV3wE7OYLZi5f6nrLyLZRgH
MD5 SHA1 SHA512 SSDEEP

Submit Download

46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe

Path C:\Windows\Temp\{17ABA65A-7D4D-49A8-A4BC-61F838EB9ED5}\.cr\46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe
Size 9.9MB
SHA256 46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb
MD5 711e1fcfc587eee41a187abd9091bfea
SHA1 cb1e234580935af2f597d9e667f8d2599368abe3
SHA512 bb0f540acf5e0e9f5044e3c2868f8aec88199ae5e9007a6df2a904a60b33079cd4d94e66ff195b898c6fe0d91075fb77a789a5e64769b6b4cba81232dc91fdb5
SSDEEP 196608:tYohctfEFaaf+vApItM1rf/c3y+OykakmBaREv12zsE1EyamEVgwNzYtdeu8T:tYictfEFv+vHC1b/cXcyGE92h1om3oYS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4900-33-0x0000000000720000-0x000000000075B000-memory.dmp

Download

memory/4900-37-0x0000000010000000-0x000000001025F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads