Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    18-06-2024 14:48

General

  • Target

    #!~#0PEn_9797_P@$SW0rd~!^!!$/Setup.exe

  • Size

    2.3MB

  • MD5

    5d52ef45b6e5bf144307a84c2af1581b

  • SHA1

    414a899ec327d4a9daa53983544245b209f25142

  • SHA256

    26a24d3b0206c6808615c7049859c2fe62c4dcd87e7858be40ae8112b0482616

  • SHA512

    458f47c1e4ccf41edaacc57abb663ee77ca098fffc596fad941bbdea67653aeabc79b34d607078b9ee5adb45614e26f5c28a09e8faf9532081fdd5dec9ac3c48

  • SSDEEP

    49152:DzO+g39FbI0eQf/Z3CarWedoYAmXviDTMtT2wkqN5K:DzO19Fnf/hdoYAm9ZkqN5K

Malware Config

Extracted

Family

stealc

rc4.plain

Signatures

  • Detect Vidar Stealer 2 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2052
    • C:\Windows\SysWOW64\netsh.exe
      C:\Windows\SysWOW64\netsh.exe
      2⤵
      • Loads dropped DLL
      • Event Triggered Execution: Netsh Helper DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1800
      • C:\Users\Admin\AppData\Local\Temp\dcom.au3
        C:\Users\Admin\AppData\Local\Temp\dcom.au3
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2828
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 148
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2772

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\83edb132
    Filesize

    6.8MB

    MD5

    20233f925c44eda22f83727c6eebe376

    SHA1

    3efd0b0161a0314d3061bc94db9b92da1cecb671

    SHA256

    3c8a28f017c8e76f29a32d33dfb8b6a1c1706c94d371e4abcac462abd6ac2255

    SHA512

    dc82cb6189c22a8d383e479deea3772d5b4a2f4d6bc0eaabe735ad109588fe5f744849008976caf6560645493a7af2f55f1723b237d3da126b57f17aaafb9051

  • \Users\Admin\AppData\Local\Temp\dcom.au3
    Filesize

    872KB

    MD5

    c56b5f0201a3b3de53e561fe76912bfd

    SHA1

    2a4062e10a5de813f5688221dbeb3f3ff33eb417

    SHA256

    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

    SHA512

    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

  • memory/1800-25-0x00000000740E0000-0x0000000074254000-memory.dmp
    Filesize

    1.5MB

  • memory/1800-20-0x00000000740E0000-0x0000000074254000-memory.dmp
    Filesize

    1.5MB

  • memory/1800-26-0x00000000740E0000-0x0000000074254000-memory.dmp
    Filesize

    1.5MB

  • memory/1800-23-0x0000000076FC0000-0x0000000077169000-memory.dmp
    Filesize

    1.7MB

  • memory/2052-18-0x0000000057000000-0x000000005703F000-memory.dmp
    Filesize

    252KB

  • memory/2052-15-0x0000000050000000-0x0000000050116000-memory.dmp
    Filesize

    1.1MB

  • memory/2052-22-0x0000000050310000-0x0000000050349000-memory.dmp
    Filesize

    228KB

  • memory/2052-19-0x0000000050120000-0x000000005030D000-memory.dmp
    Filesize

    1.9MB

  • memory/2052-21-0x0000000057800000-0x0000000057812000-memory.dmp
    Filesize

    72KB

  • memory/2052-11-0x00000000740E0000-0x0000000074254000-memory.dmp
    Filesize

    1.5MB

  • memory/2052-17-0x0000000059800000-0x000000005986E000-memory.dmp
    Filesize

    440KB

  • memory/2052-10-0x00000000740F2000-0x00000000740F4000-memory.dmp
    Filesize

    8KB

  • memory/2052-14-0x0000000000400000-0x0000000000698000-memory.dmp
    Filesize

    2.6MB

  • memory/2052-0-0x00000000740E0000-0x0000000074254000-memory.dmp
    Filesize

    1.5MB

  • memory/2052-12-0x00000000740E0000-0x0000000074254000-memory.dmp
    Filesize

    1.5MB

  • memory/2052-1-0x0000000076FC0000-0x0000000077169000-memory.dmp
    Filesize

    1.7MB

  • memory/2828-32-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
    Filesize

    4KB

  • memory/2828-31-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
    Filesize

    4KB

  • memory/2828-34-0x0000000000B30000-0x000000000127C000-memory.dmp
    Filesize

    7.3MB

  • memory/2828-43-0x0000000000B30000-0x000000000127C000-memory.dmp
    Filesize

    7.3MB