Analysis Overview
SHA256
e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829
Threat Level: Known bad
The file e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829 was found to be: Known bad.
Malicious Activity Summary
Vidar
Detect Vidar Stealer
Stealc
RisePro
Downloads MZ/PE file
Executes dropped EXE
Accesses cryptocurrency files/wallets, possible credential harvesting
Suspicious use of SetThreadContext
Unsigned PE
Checks processor information in registry
Delays execution with timeout.exe
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-15 12:28
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-15 12:28
Reported
2024-06-15 12:31
Platform
win10v2004-20240611-en
Max time kernel
149s
Max time network
150s
Command Line
Signatures
Detect Vidar Stealer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
RisePro
Stealc
Vidar
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\GIJJKFCGDG.exe | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3084 set thread context of 2260 | N/A | C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
| PID 1096 set thread context of 1864 | N/A | C:\ProgramData\GIJJKFCGDG.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe
"C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
C:\ProgramData\GIJJKFCGDG.exe
"C:\ProgramData\GIJJKFCGDG.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\JJKEBGHJKFID" & exit
C:\Windows\SysWOW64\timeout.exe
timeout /t 10
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | t.me | udp |
| NL | 149.154.167.99:443 | t.me | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.167.154.149.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 144.107.17.2.in-addr.arpa | udp |
| DE | 195.201.251.58:9000 | 195.201.251.58 | tcp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 13.107.21.237:443 | g.bing.com | tcp |
| DE | 195.201.251.58:9000 | 195.201.251.58 | tcp |
| BE | 88.221.83.185:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 23.249.124.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.251.201.195.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.32.126.40.in-addr.arpa | udp |
| DE | 195.201.251.58:9000 | 195.201.251.58 | tcp |
| DE | 195.201.251.58:9000 | 195.201.251.58 | tcp |
| US | 8.8.8.8:53 | 237.21.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 185.83.221.88.in-addr.arpa | udp |
| DE | 195.201.251.58:9000 | 195.201.251.58 | tcp |
| DE | 195.201.251.58:9000 | 195.201.251.58 | tcp |
| DE | 195.201.251.58:9000 | 195.201.251.58 | tcp |
| DE | 195.201.251.58:9000 | 195.201.251.58 | tcp |
| DE | 195.201.251.58:9000 | 195.201.251.58 | tcp |
| DE | 195.201.251.58:9000 | 195.201.251.58 | tcp |
| DE | 195.201.251.58:9000 | tcp | |
| DE | 195.201.251.58:9000 | tcp | |
| DE | 195.201.251.58:9000 | tcp | |
| DE | 195.201.251.58:9000 | tcp | |
| DE | 195.201.251.58:9000 | tcp | |
| DE | 195.201.251.58:9000 | tcp | |
| DE | 195.201.251.58:9000 | 195.201.251.58 | tcp |
| DE | 195.201.251.58:9000 | 195.201.251.58 | tcp |
| RU | 5.42.65.116:80 | 5.42.65.116 | tcp |
| DE | 195.201.251.58:9000 | 195.201.251.58 | tcp |
| US | 8.8.8.8:53 | 116.65.42.5.in-addr.arpa | udp |
| DE | 195.201.251.58:9000 | 195.201.251.58 | tcp |
| DE | 195.201.251.58:9000 | 195.201.251.58 | tcp |
| DE | 195.201.251.58:9000 | 195.201.251.58 | tcp |
| DE | 195.201.251.58:9000 | 195.201.251.58 | tcp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 100.58.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | udp |
Files
memory/3084-0-0x0000000074DFE000-0x0000000074DFF000-memory.dmp
memory/3084-1-0x0000000000530000-0x0000000000970000-memory.dmp
memory/3084-2-0x0000000005390000-0x000000000542C000-memory.dmp
memory/3084-3-0x0000000074DF0000-0x00000000755A0000-memory.dmp
memory/3084-4-0x0000000005540000-0x00000000055EA000-memory.dmp
memory/3084-5-0x0000000005350000-0x000000000536C000-memory.dmp
memory/3084-61-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-65-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-63-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-59-0x0000000005350000-0x0000000005365000-memory.dmp
memory/2260-68-0x0000000000400000-0x0000000000648000-memory.dmp
memory/2260-67-0x0000000000400000-0x0000000000648000-memory.dmp
memory/3084-57-0x0000000005350000-0x0000000005365000-memory.dmp
memory/2260-71-0x0000000000400000-0x0000000000648000-memory.dmp
memory/3084-70-0x0000000074DF0000-0x00000000755A0000-memory.dmp
memory/3084-55-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-72-0x0000000074DF0000-0x00000000755A0000-memory.dmp
memory/3084-53-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-51-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-47-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-45-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-43-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-41-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-39-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-35-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-33-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-31-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-29-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-27-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-26-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-21-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-19-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-17-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-15-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-13-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-11-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-9-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-6-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-49-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-37-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-23-0x0000000005350000-0x0000000005365000-memory.dmp
memory/3084-7-0x0000000005350000-0x0000000005365000-memory.dmp
memory/2260-84-0x0000000000400000-0x0000000000648000-memory.dmp
C:\ProgramData\GIJJKFCGDG.exe
| MD5 | 7fc744e8d5f2c7c533dd995a5d0c1d30 |
| SHA1 | f8220ea06b9c3e5d31a203f63787bd502780f33c |
| SHA256 | 00bb335318bc7964d7d8f58e4e3688d340431a5f38998ee257898c88874b0797 |
| SHA512 | c3a96071bdabaaca5689f11c14505d0d4bd8f877a7aaf6ce5b376db46cd589819bf810c68f704197a9a91b7ce46217e7a05c3f86b7d64cd61a7a367178e68aeb |
memory/1096-144-0x0000000000360000-0x0000000000533000-memory.dmp
memory/1096-145-0x0000000000360000-0x0000000000533000-memory.dmp
memory/1864-149-0x0000000000400000-0x0000000000596000-memory.dmp
memory/2260-152-0x0000000000400000-0x0000000000648000-memory.dmp
memory/1864-153-0x0000000000400000-0x0000000000596000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-15 12:28
Reported
2024-06-15 12:31
Platform
win11-20240508-en
Max time kernel
114s
Max time network
124s
Command Line
Signatures
Detect Vidar Stealer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Stealc
Vidar
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1876 set thread context of 1892 | N/A | C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe
"C:\Users\Admin\AppData\Local\Temp\e185b5ac05bf0947b5fd19b8f0892afa4fcbbceba5fc76ad52ae3fdef2045829.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\KEHDHIDAEHCF" & exit
C:\Windows\SysWOW64\timeout.exe
timeout /t 10
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | t.me | udp |
| US | 8.8.8.8:53 | steamcommunity.com | udp |
Files
memory/1876-0-0x00000000751BE000-0x00000000751BF000-memory.dmp
memory/1876-1-0x0000000000430000-0x0000000000870000-memory.dmp
memory/1876-2-0x0000000005210000-0x00000000052AC000-memory.dmp
memory/1876-3-0x0000000005330000-0x00000000053DA000-memory.dmp
memory/1876-4-0x00000000751B0000-0x0000000075961000-memory.dmp
memory/1876-5-0x00000000051D0000-0x00000000051EC000-memory.dmp
memory/1876-31-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-29-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-27-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-25-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-23-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-21-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-19-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-17-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-15-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-13-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-11-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-9-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-7-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-6-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-65-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1892-66-0x0000000000400000-0x0000000000648000-memory.dmp
memory/1892-71-0x0000000000400000-0x0000000000648000-memory.dmp
memory/1876-70-0x00000000751B0000-0x0000000075961000-memory.dmp
memory/1892-68-0x0000000000400000-0x0000000000648000-memory.dmp
memory/1876-63-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-61-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-59-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-57-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-55-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-53-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-72-0x00000000751B0000-0x0000000075961000-memory.dmp
memory/1876-51-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-49-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-47-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-45-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-43-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-41-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-39-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-37-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-35-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1876-33-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/1892-73-0x0000000000400000-0x0000000000648000-memory.dmp
memory/1892-74-0x0000000000400000-0x0000000000648000-memory.dmp
memory/1892-76-0x0000000000400000-0x0000000000648000-memory.dmp