Analysis

  • max time kernel
    90s
  • max time network
    56s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/06/2024, 01:16

General

  • Target

    ##!!SetUp_5566_Pa$sW0rd$$!!/Setup.exe

  • Size

    5.4MB

  • MD5

    ad2735f096925010a53450cb4178c89e

  • SHA1

    c6d65163c6315a642664f4eaec0fae9528549bfe

  • SHA256

    4e775b5fafb4e6d89a4694f8694d2b8b540534bd4a52ff42f70095f1c929160e

  • SHA512

    1868b22a7c5cba89545b06f010c09c5418b3d86039099d681eee9567c47208fdba3b89c6251cf03c964c58c805280d45ba9c3533125f6bd3e0bc067477e03ab9

  • SSDEEP

    98304:o/zx+riUDpJowboU+XEsumY2XW6jBYeZ1ER:2x+riUDwUj12X1tY5

Malware Config

Extracted

Family

stealc

rc4.plain

Signatures

  • Detect Vidar Stealer 3 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Detects Windows executables referencing non-Windows User-Agents 3 IoCs
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 3 IoCs
  • Detects executables containing potential Windows Defender anti-emulation checks 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 1 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3288
    • C:\Windows\SysWOW64\netsh.exe
      C:\Windows\SysWOW64\netsh.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2096
      • C:\Users\Admin\AppData\Local\Temp\coml.au3
        C:\Users\Admin\AppData\Local\Temp\coml.au3
        3⤵
        • Checks computer location settings
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3164
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\coml.au3" & rd /s /q "C:\ProgramData\DGIJEGHDAECA" & exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1952
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 10
            5⤵
            • Delays execution with timeout.exe
            PID:1804

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\c02fa9c8

    Filesize

    6.8MB

    MD5

    0fe42443907005df9867dd37536a4e6c

    SHA1

    4376698a223bf72d5988648552ce316ca81d194a

    SHA256

    586610bd6d117fa30bb08bcaf91fc5a0b98f89ced776d600c56a5bd02101ff94

    SHA512

    d22edf65277e53fec3866a7ded97d5ba31e88663831d543e337cdcc523571d6f3abd506c70bb0268791e2de09930cdd0a481d2c5e86c69b2c46a9b869cc13dbb

  • C:\Users\Admin\AppData\Local\Temp\coml.au3

    Filesize

    872KB

    MD5

    c56b5f0201a3b3de53e561fe76912bfd

    SHA1

    2a4062e10a5de813f5688221dbeb3f3ff33eb417

    SHA256

    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

    SHA512

    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

  • memory/2096-20-0x0000000073EEE000-0x0000000073EF0000-memory.dmp

    Filesize

    8KB

  • memory/2096-17-0x00007FFA14610000-0x00007FFA14805000-memory.dmp

    Filesize

    2.0MB

  • memory/2096-21-0x0000000073EE1000-0x0000000073EEF000-memory.dmp

    Filesize

    56KB

  • memory/2096-24-0x0000000073EE1000-0x0000000073EEF000-memory.dmp

    Filesize

    56KB

  • memory/3164-26-0x0000000000ED0000-0x000000000161C000-memory.dmp

    Filesize

    7.3MB

  • memory/3164-28-0x00007FFA14610000-0x00007FFA14805000-memory.dmp

    Filesize

    2.0MB

  • memory/3164-29-0x0000000000ED0000-0x000000000161C000-memory.dmp

    Filesize

    7.3MB

  • memory/3164-31-0x0000000061E00000-0x0000000061EF3000-memory.dmp

    Filesize

    972KB

  • memory/3164-43-0x0000000000ED0000-0x000000000161C000-memory.dmp

    Filesize

    7.3MB

  • memory/3288-14-0x00007FF9F6060000-0x00007FF9F61D2000-memory.dmp

    Filesize

    1.4MB

  • memory/3288-13-0x00007FF9F6060000-0x00007FF9F61D2000-memory.dmp

    Filesize

    1.4MB

  • memory/3288-0-0x00007FF9F6060000-0x00007FF9F61D2000-memory.dmp

    Filesize

    1.4MB

  • memory/3288-12-0x00007FF9F6078000-0x00007FF9F6079000-memory.dmp

    Filesize

    4KB