stealc | 6ba9d7cfc6378cdeeb2006a0cf9014c9a10bb3f1d480bebc435de97307868d7c

Resubmissions

18-06-2024 17:22

240618-vxq7jasfpg 10

18-06-2024 17:19

240618-vvtjwasfjh 10

Analysis

max time kernel
79s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-06-2024 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

files/Setup.exe
Size

446KB
MD5

485008b43f0edceba0e0d3ca04bc1c1a
SHA1

55ae8f105af415bb763d1b87f6572f078052877c
SHA256

12c22ba646232d5d5087d0300d5cfd46fed424f26143a02dc866f1bfceab3c10
SHA512

402652786daae635c7405f5fa0924d768cbde2086f9f57b10f00f921dec98e37168f5c3a6baa5593ba9a478f3971d32747c517ffd485d25634c924e6b08815b1
SSDEEP

12288:vK5+DMJA3TAz4plk9iZOOti81N5y1qMIg+GV5Zul3M:y5+DMJA3TAz4plk9ijK1qlGV7ulM

Score

10^/10

stealc vidar discovery persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

stealc

rc4.plain

Signatures

Detect Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral8/memory/4760-22-0x00000000012A0000-0x00000000019EC000-memory.dmp	family_vidar_v7
behavioral8/memory/4760-43-0x00000000012A0000-0x00000000019EC000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

dcom.au3

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation dcom.au3
Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 2860 set thread context of 3400 2860 Setup.exe netsh.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Loads dropped DLL 1 IoCs

Processes:

dcom.au3

pid process

4760 dcom.au3
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	dcom.au3

description	pid	process	target process
PID 2860 set thread context of 3400	2860	Setup.exe	netsh.exe

pid	process
4760	dcom.au3

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

dcom.au3

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dcom.au3
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3136 timeout.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Setup.exenetsh.exedcom.au3

pid process

2860 Setup.exe
2860 Setup.exe
3400 netsh.exe
3400 netsh.exe
4760 dcom.au3
4760 dcom.au3
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

Setup.exenetsh.exe

pid process

2860 Setup.exe
3400 netsh.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dcom.au3

pid	process
3136	timeout.exe

pid	process
2860	Setup.exe
2860	Setup.exe
3400	netsh.exe
3400	netsh.exe
4760	dcom.au3
4760	dcom.au3

pid	process
2860	Setup.exe
3400	netsh.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Setup.exenetsh.exedcom.au3cmd.exe

description	pid	process	target process
PID 2860 wrote to memory of 3400	2860	Setup.exe	netsh.exe
PID 2860 wrote to memory of 3400	2860	Setup.exe	netsh.exe
PID 2860 wrote to memory of 3400	2860	Setup.exe	netsh.exe
PID 2860 wrote to memory of 3400	2860	Setup.exe	netsh.exe
PID 3400 wrote to memory of 4760	3400	netsh.exe	dcom.au3
PID 3400 wrote to memory of 4760	3400	netsh.exe	dcom.au3
PID 3400 wrote to memory of 4760	3400	netsh.exe	dcom.au3
PID 3400 wrote to memory of 4760	3400	netsh.exe	dcom.au3
PID 3400 wrote to memory of 4760	3400	netsh.exe	dcom.au3
PID 4760 wrote to memory of 4332	4760	dcom.au3	cmd.exe
PID 4760 wrote to memory of 4332	4760	dcom.au3	cmd.exe
PID 4760 wrote to memory of 4332	4760	dcom.au3	cmd.exe
PID 4332 wrote to memory of 3136	4332	cmd.exe	timeout.exe
PID 4332 wrote to memory of 3136	4332	cmd.exe	timeout.exe
PID 4332 wrote to memory of 3136	4332	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\files\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\files\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netsh.exe
2⤵
- Event Triggered Execution: Netsh Helper DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3400

C:\Users\Admin\AppData\Local\Temp\dcom.au3
C:\Users\Admin\AppData\Local\Temp\dcom.au3
3⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4760

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\files\Setup.exe" & rd /s /q "C:\ProgramData\HIEHDAFHDHCB" & exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4332

C:\Windows\SysWOW64\timeout.exe
timeout /t 10
5⤵
- Delays execution with timeout.exe
PID:3136

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9c911c0a
Filesize
6.8MB

MD5
032340f6a039ad8f82b629aadcd85ebb

SHA1
64659a225699344156f6a42d699fd8167cfdfe7d

SHA256
2eecad24fedb31748d733699e7f9a32b6610d72b7956bd36239cd3281cf52ff5

SHA512
c427a0f18f1a23896224c1559da7c238da0dc301994dd15aaefbaad145e0cca6e5b57fe8e4d9d1f6391c288be103d41e776dd38714ee5ba5a6ca3b6d3ec6cc84

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcom.au3
Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
memory/2860-0-0x00000000749C0000-0x0000000074B3B000-memory.dmp

Filesize
1.5MB

Download
memory/2860-1-0x00007FFFBC790000-0x00007FFFBC985000-memory.dmp

Filesize
2.0MB

Download
memory/2860-7-0x00000000749D2000-0x00000000749D4000-memory.dmp

Filesize
8KB

Download
memory/2860-8-0x00000000749C0000-0x0000000074B3B000-memory.dmp

Filesize
1.5MB

Download
memory/2860-9-0x00000000749C0000-0x0000000074B3B000-memory.dmp

Filesize
1.5MB

Download
memory/3400-16-0x00000000749C1000-0x00000000749CF000-memory.dmp

Filesize
56KB

Download
memory/3400-13-0x00007FFFBC790000-0x00007FFFBC985000-memory.dmp

Filesize
2.0MB

Download
memory/3400-15-0x00000000749CE000-0x00000000749D0000-memory.dmp

Filesize
8KB

Download
memory/3400-20-0x00000000749C1000-0x00000000749CF000-memory.dmp

Filesize
56KB

Download
memory/3400-11-0x00000000749C1000-0x00000000749CF000-memory.dmp

Filesize
56KB

Download
memory/4760-22-0x00000000012A0000-0x00000000019EC000-memory.dmp

Filesize
7.3MB

Download
memory/4760-24-0x00007FFFBC790000-0x00007FFFBC985000-memory.dmp

Filesize
2.0MB

Download
memory/4760-25-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4760-43-0x00000000012A0000-0x00000000019EC000-memory.dmp

Filesize
7.3MB

Download