Analysis
- max time kernel
3s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
10/06/2024, 02:12
General
- Target 4f442d5f511fe820b75a49169785dac48fce1a19285372b47c5e4ab62209df1a.exe
- Size 2.4MB
- Sample240610-cm66wsbb68
- SHA256 4f442d5f511fe820b75a49169785dac48fce1a19285372b47c5e4ab62209df1a
Malware Config
Extracted
-
stealc
Extracted
-
vidar
-
https://t.me/r8z0l
-
https://steamcommunity.com/profiles/76561199698764354
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Signatures
- Detect Vidar Stealer 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
- Detects executables containing potential Windows Defender anti-emulation checks 1 IoCs
- Downloads MZ/PE file
- Delays execution with timeout.exe 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f442d5f511fe820b75a49169785dac48fce1a19285372b47c5e4ab62209df1a.exe"C:\Users\Admin\AppData\Local\Temp\4f442d5f511fe820b75a49169785dac48fce1a19285372b47c5e4ab62209df1a.exe"1⤵
-
C:\ProgramData\KFIJJEGHDA.exe"C:\ProgramData\KFIJJEGHDA.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\EHIJDHCAKKFC" & exit2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 103⤵
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
KFIJJEGHDA.exe
memory/1704-57-0x00000000010B0000-0x00000000010B1000-memory.dmp
memory/2996-7-0x000000001BE70000-0x000000001C0CF000-memory.dmp
memory/2996-0-0x0000000000490000-0x0000000000B53000-memory.dmp
memory/4376-64-0x00000000086F0000-0x0000000008D08000-memory.dmp
memory/4376-68-0x0000000008350000-0x000000000839C000-memory.dmp
memory/4376-60-0x0000000005810000-0x0000000005DB4000-memory.dmp
memory/4376-61-0x0000000005350000-0x00000000053E2000-memory.dmp
memory/4376-62-0x0000000072820000-0x0000000072FD0000-memory.dmp
memory/4376-63-0x0000000005510000-0x000000000551A000-memory.dmp
memory/4376-58-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4376-66-0x0000000008180000-0x0000000008192000-memory.dmp
memory/4376-67-0x00000000081E0000-0x000000000821C000-memory.dmp
memory/4376-59-0x000000007282E000-0x000000007282F000-memory.dmp
memory/4376-65-0x0000000008240000-0x000000000834A000-memory.dmp
memory/4376-69-0x00000000084D0000-0x0000000008536000-memory.dmp
memory/4376-70-0x0000000008F90000-0x0000000009006000-memory.dmp
memory/4376-71-0x0000000008F10000-0x0000000008F2E000-memory.dmp
memory/4376-72-0x000000000A210000-0x000000000A3D2000-memory.dmp
memory/4376-73-0x000000000A910000-0x000000000AE3C000-memory.dmp
memory/4376-75-0x0000000072820000-0x0000000072FD0000-memory.dmp