Malware Analysis Report

2024-09-11 16:49

Sample ID 240615-ph937stgrn
Target 25cbba8cb4b96c8b9e6c8490c2460eb8fecb3b6dd4eb8fc2a06392cb018dda5b.zip
SHA256 25cbba8cb4b96c8b9e6c8490c2460eb8fecb3b6dd4eb8fc2a06392cb018dda5b
Tags
stealc vidar discovery spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

25cbba8cb4b96c8b9e6c8490c2460eb8fecb3b6dd4eb8fc2a06392cb018dda5b

Threat Level: Known bad

The file 25cbba8cb4b96c8b9e6c8490c2460eb8fecb3b6dd4eb8fc2a06392cb018dda5b.zip was found to be: Known bad.

Malicious Activity Summary

stealc vidar discovery spyware stealer

Stealc

Detect Vidar Stealer

Vidar

Checks computer location settings

Reads data files stored by FTP clients

Loads dropped DLL

Checks installed software on the system

Suspicious use of SetThreadContext

Enumerates physical storage devices

Program crash

Unsigned PE

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Delays execution with timeout.exe

Checks processor information in registry

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-15 12:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win10v2004-20240611-en

Max time kernel

92s

Max time network

100s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_app.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4272 wrote to memory of 4352 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4272 wrote to memory of 4352 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4272 wrote to memory of 4352 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4352 -ip 4352

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 604

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\VSLauncher_[0MB]_[1].exe"

Network

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

53s

Command Line

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Reads data files stored by FTP clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3800 set thread context of 4500 N/A C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe C:\Windows\SysWOW64\netsh.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3800 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 3800 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 3800 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 3800 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 4500 wrote to memory of 2648 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4500 wrote to memory of 2648 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4500 wrote to memory of 2648 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4500 wrote to memory of 2648 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4500 wrote to memory of 2648 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2648 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\cmd.exe
PID 3816 wrote to memory of 4852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3816 wrote to memory of 4852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3816 wrote to memory of 4852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\coml.au3" & rd /s /q "C:\ProgramData\FBFCGIDAKECG" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country Destination Domain Proto
US 8.8.8.8:53 feeldog.xyz udp
US 8.8.8.8:53 t.me udp

Files

memory/3800-0-0x00007FFA12420000-0x00007FFA12592000-memory.dmp

memory/3800-12-0x00007FFA12438000-0x00007FFA12439000-memory.dmp

memory/3800-13-0x00007FFA12420000-0x00007FFA12592000-memory.dmp

memory/3800-14-0x00007FFA12420000-0x00007FFA12592000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9d2c6a01

MD5 748b9cd0bd79ceb7c94c6119262ff0c6
SHA1 ffa70c183aafdcd95515bcf040375d717a473ded
SHA256 603afc4082483bd3ec76b676b148853e475211eaab86aac106b485266639c6fb
SHA512 862f7834673c1f7b5c1a52cbc4026713e62642afee1f7f4b43b014239c1ede25a57d96f6aeb1963a76b9ee450e92b4c3b969491778377c4fe5a8b7abf042de4a

memory/4500-17-0x00007FFA217B0000-0x00007FFA219A5000-memory.dmp

memory/4500-20-0x0000000074031000-0x000000007403F000-memory.dmp

memory/4500-19-0x000000007403E000-0x0000000074040000-memory.dmp

memory/4500-24-0x0000000074031000-0x000000007403F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\coml.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/2648-26-0x0000000001200000-0x000000000194C000-memory.dmp

memory/2648-28-0x00007FFA217B0000-0x00007FFA219A5000-memory.dmp

memory/2648-29-0x0000000001200000-0x000000000194C000-memory.dmp

memory/2648-31-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/2648-43-0x0000000001200000-0x000000000194C000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\libssl-1_1-x64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\libssl-1_1-x64.dll,#1

Network

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win7-20240611-en

Max time kernel

120s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\libcrypto-1_1-x64.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1460 wrote to memory of 1632 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1460 wrote to memory of 1632 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1460 wrote to memory of 1632 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\libcrypto-1_1-x64.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1460 -s 104

Network

N/A

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win7-20240611-en

Max time kernel

118s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\msvcp140_1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\msvcp140_1.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:24

Platform

win10v2004-20240226-en

Max time kernel

135s

Max time network

162s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win7-20240221-en

Max time kernel

119s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\HDHelper_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win7-20240220-en

Max time kernel

120s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\VSLauncher_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\api-ms-win-core-profile-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\api-ms-win-core-profile-l1-1-0.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win7-20240508-en

Max time kernel

119s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Qt5Network.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Qt5Network.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win7-20240611-en

Max time kernel

118s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2416 wrote to memory of 2932 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2416 wrote to memory of 2932 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2416 wrote to memory of 2932 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2416 -s 84

Network

N/A

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win7-20240220-en

Max time kernel

119s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\steam_api64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\steam_api64.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win7-20240611-en

Max time kernel

147s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1932 set thread context of 2816 N/A C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe C:\Windows\SysWOW64\netsh.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\coml.au3

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1932 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1932 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1932 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1932 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1932 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 2816 wrote to memory of 2632 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2816 wrote to memory of 2632 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2816 wrote to memory of 2632 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2816 wrote to memory of 2632 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2816 wrote to memory of 2632 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2816 wrote to memory of 2632 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2632 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\WerFault.exe
PID 2632 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\WerFault.exe
PID 2632 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\WerFault.exe
PID 2632 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 148

Network

N/A

Files

memory/1932-0-0x000007FEF5850000-0x000007FEF59A8000-memory.dmp

memory/1932-12-0x000007FEF5868000-0x000007FEF5869000-memory.dmp

memory/1932-13-0x000007FEF5850000-0x000007FEF59A8000-memory.dmp

memory/1932-14-0x000007FEF5850000-0x000007FEF59A8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1c282035

MD5 8d600cbffc89e23322ab4c50dd7152a0
SHA1 03edf4546df4c004687bdf8914ae72c8e4865249
SHA256 0b41c68522d2dc2a0d7ac91efa233f985903357176d4dd07843b54754b3ace9a
SHA512 b6cba4348a457ba27b1da9ed8e8d9645d4cd45d3c56ee975b823687fb187e2f2f1abc5720f4bea322cfff344c0283be1fa76bec9ea9b8526f423128355222b87

memory/2816-17-0x0000000077050000-0x00000000771F9000-memory.dmp

memory/2816-20-0x000000007335E000-0x0000000073360000-memory.dmp

memory/2816-19-0x0000000073350000-0x00000000734C4000-memory.dmp

memory/2816-24-0x0000000073350000-0x00000000734C4000-memory.dmp

\Users\Admin\AppData\Local\Temp\coml.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/2632-27-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2632-26-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2816-28-0x0000000073350000-0x00000000734C4000-memory.dmp

memory/2632-31-0x0000000000BB0000-0x00000000012FC000-memory.dmp

memory/2632-39-0x0000000000BB0000-0x00000000012FC000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win7-20240508-en

Max time kernel

121s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\libssl-1_1-x64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\libssl-1_1-x64.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win10v2004-20240508-en

Max time kernel

134s

Max time network

140s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Qt5Network.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Qt5Network.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4352,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win7-20240221-en

Max time kernel

121s

Max time network

126s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\hogg.pptx"

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2844 wrote to memory of 1284 N/A C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE C:\Windows\splwow64.exe
PID 2844 wrote to memory of 1284 N/A C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE C:\Windows\splwow64.exe
PID 2844 wrote to memory of 1284 N/A C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE C:\Windows\splwow64.exe
PID 2844 wrote to memory of 1284 N/A C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE C:\Windows\splwow64.exe

Processes

C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\hogg.pptx"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

N/A

Files

memory/2844-0-0x000000002D501000-0x000000002D502000-memory.dmp

memory/2844-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2844-2-0x0000000072C0D000-0x0000000072C18000-memory.dmp

memory/2844-5-0x0000000072C0D000-0x0000000072C18000-memory.dmp

memory/2844-6-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2844-7-0x0000000072C0D000-0x0000000072C18000-memory.dmp

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win7-20240611-en

Max time kernel

121s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_app.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1792 wrote to memory of 2596 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1792 wrote to memory of 2596 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1792 wrote to memory of 2596 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1792 wrote to memory of 2596 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1792 wrote to memory of 2596 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1792 wrote to memory of 2596 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1792 wrote to memory of 2596 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_app.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

53s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\libcrypto-1_1-x64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\libcrypto-1_1-x64.dll,#1

Network

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win10v2004-20240508-en

Max time kernel

144s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_1.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4288,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8

Network

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\msvcp140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\msvcp140.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 52.111.227.13:443 tcp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win7-20231129-en

Max time kernel

118s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_1.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2372 wrote to memory of 2544 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2372 wrote to memory of 2544 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2372 wrote to memory of 2544 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\vcruntime140_1.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2372 -s 80

Network

N/A

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win7-20240611-en

Max time kernel

118s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

55s

Command Line

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\NvStereoUtilityOGL_[1MB]_[1].exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\NvStereoUtilityOGL_[1MB]_[1].exe

Processes

C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2884 -ip 2884

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2884 -ip 2884

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 540

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win7-20240508-en

Max time kernel

117s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\msvcp140.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1704 wrote to memory of 2488 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1704 wrote to memory of 2488 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1704 wrote to memory of 2488 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\msvcp140.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1704 -s 80

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:24

Platform

win10v2004-20240226-en

Max time kernel

140s

Max time network

158s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\hogg.pptx" /ou ""

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE

"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\hogg.pptx" /ou ""

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 27.73.42.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.200.42:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 29.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 57.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 175.117.168.52.in-addr.arpa udp

Files

memory/1260-0-0x00007FFC81410000-0x00007FFC81420000-memory.dmp

memory/1260-3-0x00007FFC81410000-0x00007FFC81420000-memory.dmp

memory/1260-2-0x00007FFC81410000-0x00007FFC81420000-memory.dmp

memory/1260-1-0x00007FFCC142D000-0x00007FFCC142E000-memory.dmp

memory/1260-5-0x00007FFC81410000-0x00007FFC81420000-memory.dmp

memory/1260-4-0x00007FFCC1390000-0x00007FFCC1585000-memory.dmp

memory/1260-6-0x00007FFC81410000-0x00007FFC81420000-memory.dmp

memory/1260-8-0x00007FFCC1390000-0x00007FFCC1585000-memory.dmp

memory/1260-7-0x00007FFCC1390000-0x00007FFCC1585000-memory.dmp

memory/1260-9-0x00007FFC7F3B0000-0x00007FFC7F3C0000-memory.dmp

memory/1260-10-0x00007FFC7F3B0000-0x00007FFC7F3C0000-memory.dmp

memory/1260-23-0x00007FFCC1390000-0x00007FFCC1585000-memory.dmp

memory/1260-24-0x00007FFCC142D000-0x00007FFCC142E000-memory.dmp

memory/1260-25-0x00007FFCC1390000-0x00007FFCC1585000-memory.dmp

memory/1260-26-0x00007FFCC1390000-0x00007FFCC1585000-memory.dmp

memory/1260-30-0x00007FFCC1390000-0x00007FFCC1585000-memory.dmp

memory/1260-38-0x00007FFC81410000-0x00007FFC81420000-memory.dmp

memory/1260-41-0x00007FFC81410000-0x00007FFC81420000-memory.dmp

memory/1260-40-0x00007FFC81410000-0x00007FFC81420000-memory.dmp

memory/1260-39-0x00007FFC81410000-0x00007FFC81420000-memory.dmp

memory/1260-42-0x00007FFCC1390000-0x00007FFCC1585000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win10v2004-20240611-en

Max time kernel

91s

Max time network

96s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\msvcp140_1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\msvcp140_1.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 57.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win10v2004-20240508-en

Max time kernel

79s

Max time network

100s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\steam_api64.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\steam_api64.dll,#1

Network

Country Destination Domain Proto
US 52.111.227.11:443 tcp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

54s

Command Line

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\HDHelper_[0MB]_[1].exe"

Network

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

58s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:23

Platform

win7-20240611-en

Max time kernel

119s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Qt5Core.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Qt5Core.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:24

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

161s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Qt5Core.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\##!!SetUp_5566_Pa$sW0rd$$!!\Qt5Core.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 172.217.16.234:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 234.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 66.229.138.52.in-addr.arpa udp

Files

N/A