Analysis
- max time kernel
29s - max time network
288s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
07/06/2024, 01:03
General
- Target b1831d15e4e3b7dc6481d57bd4e471ccc36b22064f4e364f7eb48eec8ee57bbd.exe
- Size 2.6MB
- Sample240607-bewjrafh56
- SHA256 b1831d15e4e3b7dc6481d57bd4e471ccc36b22064f4e364f7eb48eec8ee57bbd
Malware Config
Extracted
-
stealc
Extracted
-
vidar
-
https://t.me/r8z0l
-
https://steamcommunity.com/profiles/76561199698764354
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Signatures
- Detect Vidar Stealer 3 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1831d15e4e3b7dc6481d57bd4e471ccc36b22064f4e364f7eb48eec8ee57bbd.exe"C:\Users\Admin\AppData\Local\Temp\b1831d15e4e3b7dc6481d57bd4e471ccc36b22064f4e364f7eb48eec8ee57bbd.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3816-0-0x0000000001220000-0x000000000191A000-memory.dmp
memory/3816-3-0x0000000073EF0000-0x0000000073FC0000-memory.dmp
memory/3816-4-0x0000000073EF0000-0x0000000073FC0000-memory.dmp
memory/3816-2-0x0000000073EF0000-0x0000000073FC0000-memory.dmp
memory/3816-7-0x0000000073EF0000-0x0000000073FC0000-memory.dmp
memory/3816-6-0x0000000073EF0000-0x0000000073FC0000-memory.dmp
memory/3816-5-0x0000000073EF0000-0x0000000073FC0000-memory.dmp
memory/3816-1-0x0000000073F06000-0x0000000073F07000-memory.dmp
memory/3816-12-0x0000000001220000-0x000000000191A000-memory.dmp
memory/3816-13-0x0000000005160000-0x00000000051FC000-memory.dmp
memory/3816-11-0x0000000073EF0000-0x0000000073FC0000-memory.dmp
memory/3816-15-0x0000000000FB0000-0x0000000000FCC000-memory.dmp
memory/3816-61-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-82-0x0000000001220000-0x000000000191A000-memory.dmp
memory/3816-83-0x0000000073EF0000-0x0000000073FC0000-memory.dmp
memory/3816-71-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-75-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-73-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-69-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-67-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-65-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-63-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-59-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-57-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-55-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-53-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-51-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-49-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-47-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-45-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-43-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-42-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-39-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-37-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-35-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-33-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-31-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-29-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-27-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-25-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-23-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-21-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-19-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-17-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-16-0x0000000000FB0000-0x0000000000FC5000-memory.dmp
memory/3816-14-0x00000000052D0000-0x000000000539E000-memory.dmp
memory/3824-81-0x0000000073EF0000-0x0000000073FC0000-memory.dmp
memory/3824-78-0x0000000000400000-0x0000000000648000-memory.dmp
memory/3824-76-0x0000000000400000-0x0000000000648000-memory.dmp
memory/3824-98-0x0000000000400000-0x0000000000648000-memory.dmp
memory/3824-129-0x0000000073EF0000-0x0000000073FC0000-memory.dmp