stealc | 211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6

Analysis

max time kernel
133s
max time network
244s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
06/06/2024, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe
Size 3.1MB
Sample240606-2xcgpsdb8z
SHA256 211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6
MD5 fbc0c6e8675214fb9d94a4cd938cfa4f
SHA1 acc2d0da08350c8eabc66ce49a70f207b2dca716
SHA512 4b1afc02f6c5978c5484731e8a4dbdc9ee58ffc06c1767524dd251c2eb2a178ad0171bd410fed68100e3333122a079227b5c6e3caeea1ed86767b942e3c2d399
SSDEEP 98304:NnJLls7aVE/GhwLiNc3OucrGlQiKff0NabA5mXsc/+hA7S+xaeV0Hu5Qr6dsPmkX:NJC7aVE/GhwLiNc3OucrGlQiKff0NabO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc vidar discovery spyware stealer

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

https://t.me/r8z0l
https://steamcommunity.com/profiles/76561199698764354

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0

Signatures

Detect Vidar Stealer 6 IoCs

stealer

resource	yara_rule
behavioral2/memory/1388-68-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/1388-71-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/1388-72-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/1388-88-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/1388-148-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/1388-149-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/4988-1-0x00000000008E0000-0x0000000000C02000-memory.dmp	net_reactor

Executes dropped EXE 2 IoCs

pid	Process
4288	BKEHDGDGHC.exe
2456	GHDHJEBFBF.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4988 set thread context of 1388	4988	211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe	73
PID 4288 set thread context of 3020	4288	BKEHDGDGHC.exe	78
PID 2456 set thread context of 3928	2456	GHDHJEBFBF.exe	80

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1972	timeout.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4988	211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe
4988	211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe
1388	MSBuild.exe
1388	MSBuild.exe
1388	MSBuild.exe
1388	MSBuild.exe
3020	RegAsm.exe
3020	RegAsm.exe
3020	RegAsm.exe
3020	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4988	211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2220	4988	211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe	72
PID 4988 wrote to memory of 2220	4988	211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe	72
PID 4988 wrote to memory of 2220	4988	211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe	72
PID 4988 wrote to memory of 1388	4988	211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe	73
PID 4988 wrote to memory of 1388	4988	211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe	73
PID 4988 wrote to memory of 1388	4988	211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe	73
PID 4988 wrote to memory of 1388	4988	211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe	73
PID 4988 wrote to memory of 1388	4988	211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe	73
PID 4988 wrote to memory of 1388	4988	211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe	73
PID 4988 wrote to memory of 1388	4988	211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe	73
PID 4988 wrote to memory of 1388	4988	211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe	73
PID 4988 wrote to memory of 1388	4988	211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe	73
PID 1388 wrote to memory of 4288	1388	MSBuild.exe	75
PID 1388 wrote to memory of 4288	1388	MSBuild.exe	75
PID 1388 wrote to memory of 4288	1388	MSBuild.exe	75
PID 4288 wrote to memory of 3092	4288	BKEHDGDGHC.exe	77
PID 4288 wrote to memory of 3092	4288	BKEHDGDGHC.exe	77
PID 4288 wrote to memory of 3092	4288	BKEHDGDGHC.exe	77
PID 4288 wrote to memory of 3020	4288	BKEHDGDGHC.exe	78
PID 4288 wrote to memory of 3020	4288	BKEHDGDGHC.exe	78
PID 4288 wrote to memory of 3020	4288	BKEHDGDGHC.exe	78
PID 4288 wrote to memory of 3020	4288	BKEHDGDGHC.exe	78
PID 4288 wrote to memory of 3020	4288	BKEHDGDGHC.exe	78
PID 4288 wrote to memory of 3020	4288	BKEHDGDGHC.exe	78
PID 4288 wrote to memory of 3020	4288	BKEHDGDGHC.exe	78
PID 4288 wrote to memory of 3020	4288	BKEHDGDGHC.exe	78
PID 4288 wrote to memory of 3020	4288	BKEHDGDGHC.exe	78
PID 1388 wrote to memory of 2456	1388	MSBuild.exe	79
PID 1388 wrote to memory of 2456	1388	MSBuild.exe	79
PID 1388 wrote to memory of 2456	1388	MSBuild.exe	79
PID 2456 wrote to memory of 3928	2456	GHDHJEBFBF.exe	80
PID 2456 wrote to memory of 3928	2456	GHDHJEBFBF.exe	80
PID 2456 wrote to memory of 3928	2456	GHDHJEBFBF.exe	80
PID 2456 wrote to memory of 3928	2456	GHDHJEBFBF.exe	80
PID 2456 wrote to memory of 3928	2456	GHDHJEBFBF.exe	80
PID 2456 wrote to memory of 3928	2456	GHDHJEBFBF.exe	80
PID 2456 wrote to memory of 3928	2456	GHDHJEBFBF.exe	80
PID 2456 wrote to memory of 3928	2456	GHDHJEBFBF.exe	80
PID 2456 wrote to memory of 3928	2456	GHDHJEBFBF.exe	80
PID 2456 wrote to memory of 3928	2456	GHDHJEBFBF.exe	80
PID 1388 wrote to memory of 4588	1388	MSBuild.exe	81
PID 1388 wrote to memory of 4588	1388	MSBuild.exe	81
PID 1388 wrote to memory of 4588	1388	MSBuild.exe	81
PID 4588 wrote to memory of 1972	4588	cmd.exe	83
PID 4588 wrote to memory of 1972	4588	cmd.exe	83
PID 4588 wrote to memory of 1972	4588	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe
"C:\Users\Admin\AppData\Local\Temp\211c57a1720a4ac495b84c7fbad60c7284a268e4dfb6d50fe0002ff9ecbaccc6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2220
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\ProgramData\BKEHDGDGHC.exe
    "C:\ProgramData\BKEHDGDGHC.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:3092
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:3020
- - C:\ProgramData\GHDHJEBFBF.exe
    "C:\ProgramData\GHDHJEBFBF.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:3928
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HIJEGDBGDBFI" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      Delays execution with timeout.exe
      PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BKEHDGDGHC.exe

Path C:\ProgramData\BKEHDGDGHC.exe
Size 421KB
SHA256 02eac2d8c04bfbabf5285b5fb1badf755e16ae50899f6bd7b788654e85a20613
MD5 277923785bb9e137228d51c5685ee0ab
SHA1 898bb333ca57a435547e17c75cddaf3db9aee116
SHA512 5ca4716d39eca08e46e1a85a28b01c66810c189fd212585dbd8a37bd9ec94e659e45ce64108a855151561278a6abbb770b1b05922fda3d7d0755ba1c824ffff8
SSDEEP 6144:DanQ+kOsq4Dfvn3ai0+02l4CSOh+mF7OPm8vvcsIExBvqioI//3CC3bxwq/FKizC:D6f4DfvniMHF7YcsIWkA/yCVdKiW
MD5 SHA1 SHA512 SSDEEP

Submit Download

JKFHII

Path C:\ProgramData\CFIEGDAEHIEH\JKFHII
Size 148KB
SHA256 7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
MD5 90a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1 aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA512 ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
SSDEEP 96:gRleseU+bF+UIYysX0xnqyZoTtczVHNrLBL7wC68:gKQ+bF+UI3ikqyZWOzVHRx7wl
MD5 SHA1 SHA512 SSDEEP

Submit Download

GHDHJEBFBF.exe

Path C:\ProgramData\GHDHJEBFBF.exe
Size 1.8MB
SHA256 32ecff2fb5d1a1786f51632b4a4cfdd79b159e56127424bf851a3724c1b0525a
MD5 6d0d2fcb8746b9d52198df1a331ca8fc
SHA1 c23ae6e0ef74626b72b66f1561610329220183c2
SHA512 6fc935b4bc418e9f5d37f0c86d3bf1d0bcf9c08a56cd61cfd6536a9c472ba817084ed931eaa4d1f01fd84ee9a9f5d107d8a55a445faf7b28123f2c98f8ab2dd9
SSDEEP 49152:3QcC2VZv5Cprzolpc13RvAj89VP2ryWZUBd68iBTUUduSgH:3QcC2V5sprMlWHvP2ImRTM5
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqls[1].dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T28YHK6H\sqls[1].dll
Size 2.3MB
SHA256 036a57102385d7f0d7b2deacf932c1c372ae30d924365b7a88f8a26657dd7550
MD5 90e744829865d57082a7f452edc90de5
SHA1 833b178775f39675fa4e55eab1032353514e1052
SHA512 0a2d112ff7cb806a74f5ec17fe097d28107bb497d6ed5ad28ea47e6795434ba903cdb49aaf97a9a99c08cd0411f1969cad93031246dc107c26606a898e570323
SSDEEP 49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5 SHA1 SHA512 SSDEEP

Submit Download

5T5SJQK9.cookie

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\5T5SJQK9.cookie
Size 102B
SHA256 3b030e42885a2d0be640e5214c7044e8860ed3196393d6a9b808af2d35885e16
MD5 3e96e0b7574a3421f650aab4b7c7bc05
SHA1 76ccebcaf46378cf22dde4f31a1a85a44ab739ae
SHA512 f5ed53a966b97cbe561ac71ff3955ca3fa27ff1a46bae25b39e36dc949bf2fa37c05a3f7a90697f2ad97adddd9074b968baa35308579dab5bd3e3b579ea45dcd
MD5 SHA1 SHA512

Submit Download

memory/1388-68-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/1388-149-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/1388-148-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/1388-88-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/1388-72-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/1388-71-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/4288-129-0x00000000005F0000-0x00000000005F1000-memory.dmp

Download

memory/4988-61-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-24-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-58-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-56-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-54-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-52-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-50-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-48-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-46-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-44-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-42-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-40-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-38-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-36-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-34-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-32-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-30-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-28-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-26-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-0-0x0000000073A7E000-0x0000000073A7F000-memory.dmp

Download

memory/4988-22-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-18-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-14-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-12-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-10-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-21-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-7-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-62-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-67-0x0000000073A70000-0x000000007415E000-memory.dmp

Download

memory/4988-64-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-73-0x0000000073A70000-0x000000007415E000-memory.dmp

Download

memory/4988-66-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-16-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-8-0x0000000005510000-0x0000000005525000-memory.dmp

Download

memory/4988-6-0x0000000005510000-0x000000000552C000-memory.dmp

Download

memory/4988-5-0x0000000005830000-0x00000000058E8000-memory.dmp

Download

memory/4988-4-0x0000000073A70000-0x000000007415E000-memory.dmp

Download

memory/4988-3-0x0000000005730000-0x0000000005834000-memory.dmp

Download

memory/4988-2-0x0000000005690000-0x000000000572C000-memory.dmp

Download

memory/4988-1-0x00000000008E0000-0x0000000000C02000-memory.dmp

Download