stealc | 12ca25e6461fd5a1178fdc0a4b23cfa88225dec174fbd48ff6587a50b24d5a38

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
#)#NEw_SetUp_33778_P@$$Key#(#/New-Setup.exe
Size 316KB
Sample240616-bdhlhaseng
SHA256 111c56593668be63e1e0c79a2d33d9e2d49cdf0c5100663c72045bc6b76e9fe6
MD5 c637e5ecf625b72f4bef9d28cd81d612
SHA1 a2c1329d290e508ee9fd0eb81e7f25d57e450f8c
SHA512 727d78bab4fab3674eec92ca5f07df6a0095ab3b973dd227c599c70e8493592bb53bb9208cc6270713283ef0065acfad3203ddcf4dcb6d43f8727f09ceaaf2e4
SSDEEP 6144:VzsRSKkhKKXDD2mTLGxelHJ+SBae3VFpSX:6VkhZWEGxelH0SBtfpS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc vidar stealer

Malware Config

Extracted

Family

stealc

rc4.plain

Signatures

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/2496-28-0x0000000000BB0000-0x00000000012FB000-memory.dmp	family_vidar_v7
behavioral1/memory/2496-37-0x0000000000BB0000-0x00000000012FB000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral1/memory/2496-28-0x0000000000BB0000-0x00000000012FB000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2496-37-0x0000000000BB0000-0x00000000012FB000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral1/memory/2496-28-0x0000000000BB0000-0x00000000012FB000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/memory/2496-37-0x0000000000BB0000-0x00000000012FB000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables containing potential Windows Defender anti-emulation checks 2 IoCs

resource	yara_rule
behavioral1/memory/2496-28-0x0000000000BB0000-0x00000000012FB000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral1/memory/2496-37-0x0000000000BB0000-0x00000000012FB000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation

Loads dropped DLL 9 IoCs

pid	Process
3068	netsh.exe
2496	coml.au3
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1920 set thread context of 3068	1920	New-Setup.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2500	2496	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1920	New-Setup.exe
1920	New-Setup.exe
3068	netsh.exe
3068	netsh.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1920	New-Setup.exe
3068	netsh.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 3068	1920	New-Setup.exe	28
PID 1920 wrote to memory of 3068	1920	New-Setup.exe	28
PID 1920 wrote to memory of 3068	1920	New-Setup.exe	28
PID 1920 wrote to memory of 3068	1920	New-Setup.exe	28
PID 1920 wrote to memory of 3068	1920	New-Setup.exe	28
PID 3068 wrote to memory of 2496	3068	netsh.exe	30
PID 3068 wrote to memory of 2496	3068	netsh.exe	30
PID 3068 wrote to memory of 2496	3068	netsh.exe	30
PID 3068 wrote to memory of 2496	3068	netsh.exe	30
PID 3068 wrote to memory of 2496	3068	netsh.exe	30
PID 3068 wrote to memory of 2496	3068	netsh.exe	30
PID 2496 wrote to memory of 2500	2496	coml.au3	31
PID 2496 wrote to memory of 2500	2496	coml.au3	31
PID 2496 wrote to memory of 2500	2496	coml.au3	31
PID 2496 wrote to memory of 2500	2496	coml.au3	31

C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\SysWOW64\netsh.exe
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Users\Admin\AppData\Local\Temp\coml.au3
    C:\Users\Admin\AppData\Local\Temp\coml.au3
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 148
      4⤵
      Loads dropped DLL
      Program crash
      PID:2500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

9d96054a

Path C:\Users\Admin\AppData\Local\Temp\9d96054a
Size 6.8MB
SHA256 fa94c8697fd1817224a6f9387c659c4d82130f0975bb81a31d1c4a69d102ca74
MD5 d1f16896489d9135cf37c6e73189cf2c
SHA1 915061324e25e1de930066d521de055310c051a8
SHA512 dc7c9377906989b6c37b382dba410a6660431e0e5b6853ca0681ec307cd7370d4c82642f277265b249970e2d3c50a2d06a141db533236ff825b3ab6f08157bf9
SSDEEP 196608:HnSom9HkMzAMPmk6EDQrZjWpCEJGBjQvt:A9EMAMu3E8VWpCEJGhct
MD5 SHA1 SHA512 SSDEEP

Submit Download

coml.au3

Path \Users\Admin\AppData\Local\Temp\coml.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1920-11-0x000007FEF5741000-0x000007FEF5759000-memory.dmp

Download

memory/1920-13-0x000007FEF5741000-0x000007FEF5759000-memory.dmp

Download

memory/1920-10-0x000007FEF5758000-0x000007FEF5759000-memory.dmp

Download

memory/2496-25-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2496-24-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2496-28-0x0000000000BB0000-0x00000000012FB000-memory.dmp

Download

memory/2496-37-0x0000000000BB0000-0x00000000012FB000-memory.dmp

Download

memory/3068-17-0x00000000733F0000-0x0000000073564000-memory.dmp

Download

memory/3068-21-0x00000000733F0000-0x0000000073564000-memory.dmp

Download

memory/3068-18-0x00000000733FE000-0x0000000073400000-memory.dmp

Download

memory/3068-15-0x00000000770F0000-0x0000000077299000-memory.dmp

Download

memory/3068-26-0x00000000733F0000-0x0000000073564000-memory.dmp

Download