stealc | 4064eb708aa0dfb0ed7c50128ff9a6e9f67d7d77636abd01c1afb093b30770e8

Analysis

max time kernel
12s
max time network
138s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4064eb708aa0dfb0ed7c50128ff9a6e9f67d7d77636abd01c1afb093b30770e8.exe
Size 1.8MB
Sample240606-3e89dsef44
SHA256 4064eb708aa0dfb0ed7c50128ff9a6e9f67d7d77636abd01c1afb093b30770e8
MD5 c125a02347e4b86e8467434066012f63
SHA1 cae8c7458c4b31027605360b1524dad4a88d1f2c
SHA512 2068325799c13312653cb1b6bdda124be77c670c1de98671ad5846c6693aec2009bc3ebcdd607073df4c3bed96ad79c738ae09700429b02c13e9be12f3074e69
SSDEEP 24576:l6z6AnPq5iak02HkUYaOV+rEfv0xwT3zxNOt4XigDSCuptNIeUaKUqm1zE:wer5l4kUYa8aesY3Ot4N7G/IeUAtK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc vidar stealer

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

https://t.me/r8z0l
https://steamcommunity.com/profiles/76561199698764354

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0

Signatures

Detect Vidar Stealer 9 IoCs

stealer

resource	yara_rule
behavioral1/memory/1672-23-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral1/memory/1672-22-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral1/memory/1672-18-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral1/memory/1672-17-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral1/memory/1672-15-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral1/memory/1672-192-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral1/memory/1672-217-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral1/memory/1672-258-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral1/memory/1672-283-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Executes dropped EXE 1 IoCs

pid	Process
1672	kat2887.tmp

Loads dropped DLL 2 IoCs

pid	Process
2340	4064eb708aa0dfb0ed7c50128ff9a6e9f67d7d77636abd01c1afb093b30770e8.exe
2340	4064eb708aa0dfb0ed7c50128ff9a6e9f67d7d77636abd01c1afb093b30770e8.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2340 set thread context of 1672	2340	4064eb708aa0dfb0ed7c50128ff9a6e9f67d7d77636abd01c1afb093b30770e8.exe	28

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	kat2887.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	kat2887.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	kat2887.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1672	2340	4064eb708aa0dfb0ed7c50128ff9a6e9f67d7d77636abd01c1afb093b30770e8.exe	28
PID 2340 wrote to memory of 1672	2340	4064eb708aa0dfb0ed7c50128ff9a6e9f67d7d77636abd01c1afb093b30770e8.exe	28
PID 2340 wrote to memory of 1672	2340	4064eb708aa0dfb0ed7c50128ff9a6e9f67d7d77636abd01c1afb093b30770e8.exe	28
PID 2340 wrote to memory of 1672	2340	4064eb708aa0dfb0ed7c50128ff9a6e9f67d7d77636abd01c1afb093b30770e8.exe	28
PID 2340 wrote to memory of 1672	2340	4064eb708aa0dfb0ed7c50128ff9a6e9f67d7d77636abd01c1afb093b30770e8.exe	28
PID 2340 wrote to memory of 1672	2340	4064eb708aa0dfb0ed7c50128ff9a6e9f67d7d77636abd01c1afb093b30770e8.exe	28
PID 2340 wrote to memory of 1672	2340	4064eb708aa0dfb0ed7c50128ff9a6e9f67d7d77636abd01c1afb093b30770e8.exe	28
PID 2340 wrote to memory of 1672	2340	4064eb708aa0dfb0ed7c50128ff9a6e9f67d7d77636abd01c1afb093b30770e8.exe	28
PID 2340 wrote to memory of 1672	2340	4064eb708aa0dfb0ed7c50128ff9a6e9f67d7d77636abd01c1afb093b30770e8.exe	28

C:\Users\Admin\AppData\Local\Temp\4064eb708aa0dfb0ed7c50128ff9a6e9f67d7d77636abd01c1afb093b30770e8.exe
"C:\Users\Admin\AppData\Local\Temp\4064eb708aa0dfb0ed7c50128ff9a6e9f67d7d77636abd01c1afb093b30770e8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\kat2887.tmp
  C:\Users\Admin\AppData\Local\Temp\kat2887.tmp
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Size 1KB
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 3e2db34015a5321d7d4531137bf752821ae176d033092d74fd86d296d76d2f6d
MD5 31470e6a9b26c4f1e70321a24512c162
SHA1 2ed6535f7e080669c78c96b632bd2657c09f8e9e
SHA512 00a0bee346e29f59095eaee2d371b3ecafd3284daebf379920787a6efbf0c8f78d19b6cc12aa05d691c8b80a3b3baacaab9391649bb33d598328cbd0ad9ed0be
MD5 SHA1 SHA512

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Size 242B
SHA256 3267fceb77021ef9be0fa1307db1117c86a8fa05318b9d4ed2463a4834c1afe3
MD5 02190d6f2ed9d3f47329e1bacd262681
SHA1 26756554558c55ed0ea4293d5c73b64f2fbfe31a
SHA512 25e8ea43208cc8009fa6394b94771038d1c9c4dc39e6759de1be0015328f0e5b600db82c9f80c7354302bb1cdf085f327f08e3e08434689f0f6b1c340659e3ae
MD5 SHA1 SHA512

Submit Download

Tar2E08.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar2E08.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

kat2887.tmp

Path C:\Users\Admin\AppData\Local\Temp\kat2887.tmp
Size 128KB
SHA256 9c2162b440540522d49223b2abb083cc77709b8737bceab953f2f9ebc06986b5
MD5 5d172f575953ff37ac7b3a88bb7615a2
SHA1 e9603a500454f232545154ac37b59c8a135a35a8
SHA512 6e7b8c5a481ac3b61aeabd84a0699d94939fb17f15faf696f05334c32d8f3712898f9e3f54d79a661a24e69f5eb118ef863d0b219b00daf55263cdc8327f2c4e
SSDEEP 3072:pzx8uB6Ncc/Kw34XC9WvIhW9YPgDE79Nz4MPLNnG7yBODf:rCNwCj0IX/dG7MO7
MD5 SHA1 SHA512 SSDEEP

Submit Download

kat2887.tmp

Path C:\Users\Admin\AppData\Local\Temp\kat2887.tmp
Size 448KB
SHA256 8cdc50bc308edd6d0f70d7c8203f0ef469daaa62ae801a00c93e6b9160fef772
MD5 d7d3e9e68f500a5362ef855382d5934b
SHA1 740495877cbcda9c61c8eb1ce3cb0c0f20738a81
SHA512 512f5d5764050274d5beb6c966c787eb50a9850ec4c4886cda14f3a912dc627d29d2cac5db7f825500041a47ce65ecc4e8f728dc934c748f6575ae17d4c2cf89
SSDEEP 12288:WNt0EArdQ0h4vglO1CYcRxJ8I4awnQb7hcr9h5Jl4:o0ESdQpglO1CxDyawn27h+9hrl4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1672-18-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/1672-14-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/1672-9-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/1672-11-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/1672-17-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/1672-283-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/1672-258-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/1672-244-0x00000000204F0000-0x000000002074F000-memory.dmp

Download

memory/1672-22-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/1672-23-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/1672-15-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/1672-192-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/1672-217-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2340-20-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/2340-0-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/2340-4-0x0000000003290000-0x00000000033DB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads