Analysis
- max time kernel
51s - max time network
53s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
15/06/2024, 01:01
General
- Target 2289656d0b1515397a4b1a827382987140dd7c0f0305be61ae2e22b2a882b392.exe
- Size 4.5MB
- Sample240615-bdmv8axcpm
- SHA256 2289656d0b1515397a4b1a827382987140dd7c0f0305be61ae2e22b2a882b392
Malware Config
Extracted
-
stealc
Extracted
-
vidar
-
https://t.me/memve4erin
-
https://steamcommunity.com/profiles/76561199699680841
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0
Signatures
- Detect Vidar Stealer 6 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Suspicious use of SetThreadContext 1 IoCs
- Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2289656d0b1515397a4b1a827382987140dd7c0f0305be61ae2e22b2a882b392.exe"C:\Users\Admin\AppData\Local\Temp\2289656d0b1515397a4b1a827382987140dd7c0f0305be61ae2e22b2a882b392.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\JEBKKEGDBFII" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- Delays execution with timeout.exe
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1040-67-0x0000000000400000-0x0000000000648000-memory.dmp
memory/1040-77-0x0000000000400000-0x0000000000648000-memory.dmp
memory/1040-75-0x0000000000400000-0x0000000000648000-memory.dmp
memory/1040-74-0x0000000000400000-0x0000000000648000-memory.dmp
memory/1040-72-0x0000000000400000-0x0000000000648000-memory.dmp
memory/1040-69-0x0000000000400000-0x0000000000648000-memory.dmp
memory/1340-42-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-36-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-28-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-32-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-66-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-64-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-62-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-60-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-58-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-56-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-54-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-52-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-50-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-48-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-46-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-44-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-0-0x000000007480E000-0x000000007480F000-memory.dmp
memory/1340-40-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-38-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-8-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-34-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-30-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-26-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-24-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-22-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-20-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-18-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-16-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-14-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-12-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-10-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-7-0x0000000003840000-0x0000000003855000-memory.dmp
memory/1340-6-0x0000000003840000-0x000000000385C000-memory.dmp
memory/1340-5-0x0000000074800000-0x0000000074FB0000-memory.dmp
memory/1340-71-0x0000000074800000-0x0000000074FB0000-memory.dmp
memory/1340-73-0x0000000074800000-0x0000000074FB0000-memory.dmp
memory/1340-4-0x0000000005F30000-0x0000000006058000-memory.dmp
memory/1340-3-0x0000000005EC0000-0x0000000005F26000-memory.dmp
memory/1340-2-0x0000000005E20000-0x0000000005EBC000-memory.dmp
memory/1340-1-0x0000000000F10000-0x000000000138E000-memory.dmp