Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
07-06-2024 01:36
Static task
static1
Behavioral task
behavioral1
Sample
c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe
Resource
win7-20240508-en
General
-
Target
c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe
-
Size
3.6MB
-
MD5
131e367009cf014321e7a70e70c4067c
-
SHA1
4c02332af53519fdae235f804f5144ba9c7e725d
-
SHA256
c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89
-
SHA512
3702fefbcf4eab279484359f61d997b7c32d9c77dd9e255a44e96de9373d18b68ff262037494203f181c359aca549020dcfea3db01d11f8f51e224261259f99e
-
SSDEEP
49152:fWN3Bsjz4Ddee7wE4o40nQaoJab9Xejv2aH0n2EBvnE8/8OhkqdHG22T9d:f6ujz4DdeClnE8f4T
Malware Config
Extracted
stealc
Extracted
vidar
https://t.me/r8z0l
https://steamcommunity.com/profiles/76561199698764354
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Signatures
-
Detect Vidar Stealer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2660-70-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exedescription pid process target process PID 2136 set thread context of 2660 2136 c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1688 timeout.exe -
Processes:
RegAsm.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegAsm.exepid process 2660 RegAsm.exe 2660 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exedescription pid process Token: SeDebugPrivilege 2136 c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exeRegAsm.execmd.exedescription pid process target process PID 2136 wrote to memory of 2660 2136 c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe RegAsm.exe PID 2136 wrote to memory of 2660 2136 c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe RegAsm.exe PID 2136 wrote to memory of 2660 2136 c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe RegAsm.exe PID 2136 wrote to memory of 2660 2136 c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe RegAsm.exe PID 2136 wrote to memory of 2660 2136 c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe RegAsm.exe PID 2136 wrote to memory of 2660 2136 c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe RegAsm.exe PID 2136 wrote to memory of 2660 2136 c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe RegAsm.exe PID 2136 wrote to memory of 2660 2136 c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe RegAsm.exe PID 2136 wrote to memory of 2660 2136 c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe RegAsm.exe PID 2136 wrote to memory of 2660 2136 c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe RegAsm.exe PID 2136 wrote to memory of 2660 2136 c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe RegAsm.exe PID 2136 wrote to memory of 2660 2136 c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe RegAsm.exe PID 2136 wrote to memory of 2660 2136 c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe RegAsm.exe PID 2660 wrote to memory of 2724 2660 RegAsm.exe cmd.exe PID 2660 wrote to memory of 2724 2660 RegAsm.exe cmd.exe PID 2660 wrote to memory of 2724 2660 RegAsm.exe cmd.exe PID 2660 wrote to memory of 2724 2660 RegAsm.exe cmd.exe PID 2724 wrote to memory of 1688 2724 cmd.exe timeout.exe PID 2724 wrote to memory of 1688 2724 cmd.exe timeout.exe PID 2724 wrote to memory of 1688 2724 cmd.exe timeout.exe PID 2724 wrote to memory of 1688 2724 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe"C:\Users\Admin\AppData\Local\Temp\c4c7045103f42bea7bc9afb11433e4f49d767be0d0b28b678a824e5627804b89.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & rd /s /q "C:\ProgramData\IJEHCGIJECFI" & exit3⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- Delays execution with timeout.exe
PID:1688
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52914e27f5fe3747b122041f7da4d7416
SHA1a3139343cc4073d4066c54bc2ce0d7b17767a0d1
SHA2564ac178bc3458ed3ed8b9f7c598c004799d3f0838199e3dc76b2aa3a3ae4de088
SHA5124d7cd179761d2028127a5b4f0b7b5fb1dd7a752692fb1ba9cfaece6c154287b0c34d40eb910c2ac4d84d43b862ee19719c9b1b09cdf91916b6eb706629dedea6
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b