stealc | 1606dc0cfa75904afa9a73126bb35935db1c49944542108f4dd4c95b06dedad4

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18/06/2024, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Set-up.exe
Size 135KB
Sample240618-qaccmsvbnc
SHA256 8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473
MD5 a2d70fbab5181a509369d96b682fc641
SHA1 22afcdc180400c4d2b9e5a6db2b8a26bff54dd38
SHA512 219c6e7e88004fad9f4392be9a852c58fc43b7f6900e40370991427f37eaea5c18f48d2954f9479dde8bcb787345f4e292d5620add8224aec4d93d7968820b83
SSDEEP 1536:URLRDTAC1CMoR1CqabJWt7AQFYMGhw1ScCD28v2Vv428fmvxOuw03h9VC:URdV1CMoiqadTQFBGhw1ED28+94hGw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc vidar discovery persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

stealc

rc4.plain

Signatures

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/memory/4836-25-0x0000000001200000-0x000000000194B000-memory.dmp	family_vidar_v7
behavioral2/memory/4836-28-0x0000000001200000-0x000000000194B000-memory.dmp	family_vidar_v7
behavioral2/memory/4836-48-0x0000000001200000-0x000000000194B000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	dcom.au3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3444 set thread context of 2932	3444	Set-up.exe	81

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Loads dropped DLL 1 IoCs

pid	Process
4836	dcom.au3

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dcom.au3

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3132	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3444	Set-up.exe
3444	Set-up.exe
2932	netsh.exe
2932	netsh.exe
4836	dcom.au3
4836	dcom.au3

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3444	Set-up.exe
2932	netsh.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 2932	3444	Set-up.exe	81
PID 3444 wrote to memory of 2932	3444	Set-up.exe	81
PID 3444 wrote to memory of 2932	3444	Set-up.exe	81
PID 3444 wrote to memory of 2932	3444	Set-up.exe	81
PID 2932 wrote to memory of 4836	2932	netsh.exe	83
PID 2932 wrote to memory of 4836	2932	netsh.exe	83
PID 2932 wrote to memory of 4836	2932	netsh.exe	83
PID 2932 wrote to memory of 4836	2932	netsh.exe	83
PID 2932 wrote to memory of 4836	2932	netsh.exe	83
PID 4836 wrote to memory of 1188	4836	dcom.au3	86
PID 4836 wrote to memory of 1188	4836	dcom.au3	86
PID 4836 wrote to memory of 1188	4836	dcom.au3	86
PID 1188 wrote to memory of 3132	1188	cmd.exe	88
PID 1188 wrote to memory of 3132	1188	cmd.exe	88
PID 1188 wrote to memory of 3132	1188	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\Set-up.exe
"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\SysWOW64\netsh.exe
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Users\Admin\AppData\Local\Temp\dcom.au3
    C:\Users\Admin\AppData\Local\Temp\dcom.au3
    3⤵
    - Checks computer location settings
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Set-up.exe" & rd /s /q "C:\ProgramData\AEHIJDAFBKFH" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1188
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:3132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a98a59fb

Path C:\Users\Admin\AppData\Local\Temp\a98a59fb
Size 6.8MB
SHA256 c63c562c151989b9e4f189be49aa1fd7ac01e944a0572de56f78a3bf0b2eeef5
MD5 01a2dc15ad631cf4f19a0a632b3c2953
SHA1 163ff9516ee5860bd7b835d145ef6c858bb783f1
SHA512 0486ff86de7cbf485f02bbd5d75cd55cf1864d5af37afc983ebfa463c219ce9216d8f0eb6cc6f7c63c70af71ce9ecff282e7fbd9e53eee46d694cbd647b8c474
SSDEEP 196608:ixj+1tvV+Nd2sgRxltJ2O9/kA2GFiImeMMFBdppn3OwzK:Wj+bV++sgRxlhcA2GFiINFBJOwzK
MD5 SHA1 SHA512 SSDEEP

Submit Download

dcom.au3

Path C:\Users\Admin\AppData\Local\Temp\dcom.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2932-23-0x0000000074861000-0x000000007486F000-memory.dmp

Download

memory/2932-18-0x000000007486E000-0x0000000074870000-memory.dmp

Download

memory/2932-19-0x0000000074861000-0x000000007486F000-memory.dmp

Download

memory/2932-16-0x00007FFA16B10000-0x00007FFA16D05000-memory.dmp

Download

memory/2932-15-0x0000000074861000-0x000000007486F000-memory.dmp

Download

memory/3444-12-0x0000000050000000-0x0000000050116000-memory.dmp

Download

memory/3444-11-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3444-13-0x0000000050120000-0x000000005030D000-memory.dmp

Download

memory/3444-0-0x0000000074860000-0x00000000749DB000-memory.dmp

Download

memory/3444-9-0x0000000074860000-0x00000000749DB000-memory.dmp

Download

memory/3444-8-0x0000000074860000-0x00000000749DB000-memory.dmp

Download

memory/3444-7-0x0000000074872000-0x0000000074874000-memory.dmp

Download

memory/3444-1-0x00007FFA16B10000-0x00007FFA16D05000-memory.dmp

Download

memory/4836-25-0x0000000001200000-0x000000000194B000-memory.dmp

Download

memory/4836-27-0x00007FFA16B10000-0x00007FFA16D05000-memory.dmp

Download

memory/4836-28-0x0000000001200000-0x000000000194B000-memory.dmp

Download

memory/4836-30-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4836-48-0x0000000001200000-0x000000000194B000-memory.dmp

Download