Analysis

  • max time kernel
    141s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    15/06/2024, 01:16

General

  • Target

    ##!!SetUp_5566_Pa$sW0rd$$!!/Setup.exe

  • Size

    5.4MB

  • MD5

    ad2735f096925010a53450cb4178c89e

  • SHA1

    c6d65163c6315a642664f4eaec0fae9528549bfe

  • SHA256

    4e775b5fafb4e6d89a4694f8694d2b8b540534bd4a52ff42f70095f1c929160e

  • SHA512

    1868b22a7c5cba89545b06f010c09c5418b3d86039099d681eee9567c47208fdba3b89c6251cf03c964c58c805280d45ba9c3533125f6bd3e0bc067477e03ab9

  • SSDEEP

    98304:o/zx+riUDpJowboU+XEsumY2XW6jBYeZ1ER:2x+riUDwUj12X1tY5

Score
10/10

Malware Config

Extracted

Family

stealc

rc4.plain

Signatures

  • Detect Vidar Stealer 2 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Detects Windows executables referencing non-Windows User-Agents 2 IoCs
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
  • Detects executables containing potential Windows Defender anti-emulation checks 2 IoCs
  • Loads dropped DLL 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Windows\SysWOW64\netsh.exe
      C:\Windows\SysWOW64\netsh.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2156
      • C:\Users\Admin\AppData\Local\Temp\coml.au3
        C:\Users\Admin\AppData\Local\Temp\coml.au3
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2424
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 148
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\a3c79cf3

    Filesize

    6.8MB

    MD5

    b66f9dad8c3785e36808e473e8344c4c

    SHA1

    3cfd2c49593814d539fbf0d2697a37b0eabac10f

    SHA256

    c8ea78c1ed06141697c20a039499b17d29a5f4bc4d852ab9030258012a79702a

    SHA512

    7db9146e37fd7e4738268adab811c6bbb6354b5c40971a28a048be37d13606870930aeacadc755ecbd0be46825f126ca0f75ab906fe031a965c13f2057bc2b70

  • \Users\Admin\AppData\Local\Temp\coml.au3

    Filesize

    872KB

    MD5

    c56b5f0201a3b3de53e561fe76912bfd

    SHA1

    2a4062e10a5de813f5688221dbeb3f3ff33eb417

    SHA256

    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

    SHA512

    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

  • memory/2156-20-0x000000007316E000-0x0000000073170000-memory.dmp

    Filesize

    8KB

  • memory/2156-17-0x0000000076E60000-0x0000000077009000-memory.dmp

    Filesize

    1.7MB

  • memory/2156-19-0x0000000073160000-0x00000000732D4000-memory.dmp

    Filesize

    1.5MB

  • memory/2156-21-0x0000000073160000-0x00000000732D4000-memory.dmp

    Filesize

    1.5MB

  • memory/2156-28-0x0000000073160000-0x00000000732D4000-memory.dmp

    Filesize

    1.5MB

  • memory/2172-14-0x000007FEF5600000-0x000007FEF5758000-memory.dmp

    Filesize

    1.3MB

  • memory/2172-13-0x000007FEF5600000-0x000007FEF5758000-memory.dmp

    Filesize

    1.3MB

  • memory/2172-0-0x000007FEF5600000-0x000007FEF5758000-memory.dmp

    Filesize

    1.3MB

  • memory/2172-12-0x000007FEF5618000-0x000007FEF5619000-memory.dmp

    Filesize

    4KB

  • memory/2424-27-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2424-26-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2424-30-0x0000000000B60000-0x00000000012AC000-memory.dmp

    Filesize

    7.3MB

  • memory/2424-39-0x0000000000B60000-0x00000000012AC000-memory.dmp

    Filesize

    7.3MB