MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-15 19:52

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240508-en

Max time kernel

62s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe"

Signatures

Detect Vidar Stealer

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Stealc

stealer stealc

Vidar

stealer vidar

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Reads data files stored by FTP clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 4748 set thread context of 4480	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe

Enumerates physical storage devices

Checks processor information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Delays execution with timeout.exe

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4748 wrote to memory of 4480	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 4748 wrote to memory of 4480	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 4748 wrote to memory of 4480	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 4748 wrote to memory of 4480	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 4480 wrote to memory of 1840	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4480 wrote to memory of 1840	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4480 wrote to memory of 1840	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4480 wrote to memory of 1840	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4480 wrote to memory of 1840	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1840 wrote to memory of 1900	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\cmd.exe
PID 1840 wrote to memory of 1900	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\cmd.exe
PID 1840 wrote to memory of 1900	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 916	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 1900 wrote to memory of 916	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 1900 wrote to memory of 916	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\coml.au3" & rd /s /q "C:\ProgramData\CBFIIEHJDBKJ" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	feeldog.xyz	udp

Files

memory/4748-0-0x00007FF840840000-0x00007FF8409B2000-memory.dmp

memory/4748-11-0x00007FF840858000-0x00007FF840859000-memory.dmp

memory/4748-12-0x00007FF840840000-0x00007FF8409B2000-memory.dmp

memory/4748-13-0x00007FF840840000-0x00007FF8409B2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a376575e

MD5	1f6deb4d9928646729400482f1f015a1
SHA1	1ebe7d1dc4309a6d35dc9f6fcf41e50379bba110
SHA256	4d74175b08b7c35fd66e7e05e5070f788d20b9f5a0a7c1c11593a8b2e22140a4
SHA512	641fed5c87512c8786431ab7df98acae3eb0558aae6d9520cb258f32e1bc7269eccb6bff743741b7c085318474dc06dcd3f89d50a7c9d5d65f542a0b491fc430

memory/4480-16-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\coml.au3

MD5	c56b5f0201a3b3de53e561fe76912bfd
SHA1	2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256	237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512	195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/1840-22-0x0000000000F10000-0x000000000165B000-memory.dmp

memory/1840-24-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

memory/1840-25-0x0000000000F10000-0x000000000165B000-memory.dmp

memory/1840-27-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/1840-39-0x0000000000F10000-0x000000000165B000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win7-20240611-en

Max time kernel

120s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\flutter_desktop_sleep_plugin.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2932 wrote to memory of 2068	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2932 wrote to memory of 2068	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 2932 wrote to memory of 2068	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\flutter_desktop_sleep_plugin.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2932 -s 212

Network

N/A

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win7-20240508-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240611-en

Max time kernel

92s

Max time network

95s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	133.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	73.144.22.2.in-addr.arpa	udp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	31.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	83.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win7-20240221-en

Max time kernel

117s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\flutter_windows.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1800 wrote to memory of 2836	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 1800 wrote to memory of 2836	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 1800 wrote to memory of 2836	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\flutter_windows.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1800 -s 204

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240611-en

Max time kernel

113s

Max time network

149s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4172,i,8447163055677043976,7218082390179600880,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	81.144.22.2.in-addr.arpa	udp
US	13.107.42.16:443		tcp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	73.144.22.2.in-addr.arpa	udp
US	8.8.8.8:53	196.131.50.23.in-addr.arpa	udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240226-en

Max time kernel

141s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_app.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3148 wrote to memory of 1900	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3148 wrote to memory of 1900	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3148 wrote to memory of 1900	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1900 -ip 1900

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	74.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	45.56.20.217.in-addr.arpa	udp
US	8.8.8.8:53	81.144.22.2.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	18.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win7-20240508-en

Max time kernel

118s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\tray_manager_plugin.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1656 wrote to memory of 1984	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 1656 wrote to memory of 1984	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 1656 wrote to memory of 1984	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\tray_manager_plugin.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1656 -s 224

Network

N/A

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win7-20240508-en

Max time kernel

121s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\url_launcher_windows_plugin.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1904 wrote to memory of 2264	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 1904 wrote to memory of 2264	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 1904 wrote to memory of 2264	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\url_launcher_windows_plugin.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1904 -s 224

Network

N/A

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-synch-l1-2-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-synch-l1-2-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win7-20231129-en

Max time kernel

118s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\msvcp140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\msvcp140.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240611-en

Max time kernel

91s

Max time network

94s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\msvcp140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\msvcp140.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	4.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	81.144.22.2.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win7-20240221-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_app.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1196 wrote to memory of 552	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1196 wrote to memory of 552	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1196 wrote to memory of 552	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1196 wrote to memory of 552	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1196 wrote to memory of 552	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1196 wrote to memory of 552	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1196 wrote to memory of 552	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 552 wrote to memory of 2200	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 552 wrote to memory of 2200	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 552 wrote to memory of 2200	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 552 wrote to memory of 2200	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 220

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win7-20240508-en

Max time kernel

122s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\VSLauncher_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\VSLauncher_[0MB]_[1].exe"

Network

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\flutter_windows.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\flutter_windows.dll,#1

Network

Country	Destination	Domain	Proto
US	52.111.229.48:443		tcp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\tray_manager_plugin.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\tray_manager_plugin.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	140.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	73.144.22.2.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	99.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	88.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	59.189.79.40.in-addr.arpa	udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win7-20240508-en

Max time kernel

149s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe"

Signatures

Detect Vidar Stealer

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Stealc

stealer stealc

Vidar

stealer vidar

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2848 set thread context of 1700	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2848 wrote to memory of 1700	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2848 wrote to memory of 1700	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2848 wrote to memory of 1700	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2848 wrote to memory of 1700	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 2848 wrote to memory of 1700	N/A	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe	C:\Windows\SysWOW64\netsh.exe
PID 1700 wrote to memory of 2056	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1700 wrote to memory of 2056	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1700 wrote to memory of 2056	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1700 wrote to memory of 2056	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1700 wrote to memory of 2056	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1700 wrote to memory of 2056	N/A	C:\Windows\SysWOW64\netsh.exe	C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2056 wrote to memory of 2552	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe
PID 2056 wrote to memory of 2552	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe
PID 2056 wrote to memory of 2552	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe
PID 2056 wrote to memory of 2552	N/A	C:\Users\Admin\AppData\Local\Temp\coml.au3	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 148

Network

N/A

Files

memory/2848-11-0x000007FEF6021000-0x000007FEF6039000-memory.dmp

memory/2848-10-0x000007FEF6038000-0x000007FEF6039000-memory.dmp

memory/2848-13-0x000007FEF6021000-0x000007FEF6039000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a353b48d

MD5	6106b6b627fc9ef652a4412c668d7d5c
SHA1	1c528f172b9153f36b075beee010f754e7c31350
SHA256	f91f7e386efa56c530967a8e2d8c8b926bac00859c5d3eb7fad274137e9629e0
SHA512	003b0f55889233f9d28dff77bb652360e9397339e3427780e1918876089fee5f8783c7258e833ea7714dd31818d662fe5d205f88e6e4d159ddd05cdd2b84ad04

memory/1700-15-0x0000000077A30000-0x0000000077BD9000-memory.dmp

\Users\Admin\AppData\Local\Temp\coml.au3

MD5	c56b5f0201a3b3de53e561fe76912bfd
SHA1	2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256	237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512	195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/1700-17-0x0000000073D20000-0x0000000073E94000-memory.dmp

memory/1700-22-0x0000000073D20000-0x0000000073E94000-memory.dmp

memory/1700-20-0x0000000073D2E000-0x0000000073D30000-memory.dmp

memory/2056-25-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2056-24-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1700-26-0x0000000073D20000-0x0000000073E94000-memory.dmp

memory/2056-28-0x0000000000610000-0x0000000000D5B000-memory.dmp

memory/2056-35-0x0000000000610000-0x0000000000D5B000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win7-20240221-en

Max time kernel

120s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\windows_single_instance_plugin.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1040 wrote to memory of 1856	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 1040 wrote to memory of 1856	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 1040 wrote to memory of 1856	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\windows_single_instance_plugin.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1040 -s 204

Network

N/A

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win7-20240611-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\HDHelper_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\url_launcher_windows_plugin.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\url_launcher_windows_plugin.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	23.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	73.144.22.2.in-addr.arpa	udp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	98.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	59.189.79.40.in-addr.arpa	udp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win7-20240508-en

Max time kernel

120s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

52s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_1.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

52s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\windows_single_instance_plugin.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\windows_single_instance_plugin.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

52s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\NvStereoUtilityOGL_[1MB]_[1].exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\NvStereoUtilityOGL_[1MB]_[1].exe

Processes

C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2840 -ip 2840

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 532

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2840 -ip 2840

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 532

Network

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240611-en

Max time kernel

92s

Max time network

97s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-profile-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-profile-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	73.144.22.2.in-addr.arpa	udp
US	8.8.8.8:53	4.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	31.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	88.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240226-en

Max time kernel

141s

Max time network

158s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\flutter_desktop_sleep_plugin.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\flutter_desktop_sleep_plugin.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	73.144.22.2.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	13.107.253.67:443		tcp
US	8.8.8.8:53	98.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	85.65.42.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win7-20240611-en

Max time kernel

117s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_1.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1968 wrote to memory of 1412	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 1968 wrote to memory of 1412	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 1968 wrote to memory of 1412	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\vcruntime140_1.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1968 -s 84

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\HDHelper_[0MB]_[1].exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	4.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	83.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	221.131.50.23.in-addr.arpa	udp
US	8.8.8.8:53	59.189.79.40.in-addr.arpa	udp

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240226-en

Max time kernel

140s

Max time network

159s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-rtlsupport-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-rtlsupport-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	69.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
GB	96.16.110.114:80		tcp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
GB	142.250.187.202:443		tcp
US	8.8.8.8:53	98.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	159.113.53.23.in-addr.arpa	udp
US	8.8.8.8:53	83.210.23.2.in-addr.arpa	udp
NL	52.142.223.178:80		tcp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	196.131.50.23.in-addr.arpa	udp
US	8.8.8.8:53	59.189.79.40.in-addr.arpa	udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-string-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-string-l1-1-0.dll,#1

Network

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-06-15 19:52

Reported

2024-06-15 19:55

Platform

win10v2004-20240611-en

Max time kernel

124s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-synch-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\x86\api-ms-win-core-synch-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4380,i,16866810346450717340,3849854439116899380,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	0.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
US	8.8.8.8:53	81.144.22.2.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	45.56.20.217.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	88.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp

Files

N/A

Sample ID	240615-ylmlrasgjh
Target	files.zip
SHA256	12ca25e6461fd5a1178fdc0a4b23cfa88225dec174fbd48ff6587a50b24d5a38
Tags	stealc vidar discovery spyware stealer

Malware Analysis Report

2024-09-11 16:52

Table of Contents