stealc | 6ba9d7cfc6378cdeeb2006a0cf9014c9a10bb3f1d480bebc435de97307868d7c

Resubmissions

18/06/2024, 17:22

240618-vxq7jasfpg10

18/06/2024, 17:19

240618-vvtjwasfjh10

Analysis

max time kernel
148s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
18/06/2024, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
files/Setup.exe
Size 446KB
Sample240618-vxq7jasfpg
SHA256 12c22ba646232d5d5087d0300d5cfd46fed424f26143a02dc866f1bfceab3c10
MD5 485008b43f0edceba0e0d3ca04bc1c1a
SHA1 55ae8f105af415bb763d1b87f6572f078052877c
SHA512 402652786daae635c7405f5fa0924d768cbde2086f9f57b10f00f921dec98e37168f5c3a6baa5593ba9a478f3971d32747c517ffd485d25634c924e6b08815b1
SSDEEP 12288:vK5+DMJA3TAz4plk9iZOOti81N5y1qMIg+GV5Zul3M:y5+DMJA3TAz4plk9ijK1qlGV7ulM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc vidar persistence privilege_escalation stealer

Malware Config

Extracted

Family

stealc

rc4.plain

Signatures

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral7/memory/2664-25-0x0000000000AE0000-0x000000000122C000-memory.dmp	family_vidar_v7
behavioral7/memory/2664-34-0x0000000000AE0000-0x000000000122C000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2116 set thread context of 2960	2116	Setup.exe	28

Loads dropped DLL 9 IoCs

pid	Process
2960	netsh.exe
2664	dcom.au3
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	2664	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2116	Setup.exe
2116	Setup.exe
2960	netsh.exe
2960	netsh.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2116	Setup.exe
2960	netsh.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2960	2116	Setup.exe	28
PID 2116 wrote to memory of 2960	2116	Setup.exe	28
PID 2116 wrote to memory of 2960	2116	Setup.exe	28
PID 2116 wrote to memory of 2960	2116	Setup.exe	28
PID 2116 wrote to memory of 2960	2116	Setup.exe	28
PID 2960 wrote to memory of 2664	2960	netsh.exe	30
PID 2960 wrote to memory of 2664	2960	netsh.exe	30
PID 2960 wrote to memory of 2664	2960	netsh.exe	30
PID 2960 wrote to memory of 2664	2960	netsh.exe	30
PID 2960 wrote to memory of 2664	2960	netsh.exe	30
PID 2960 wrote to memory of 2664	2960	netsh.exe	30
PID 2664 wrote to memory of 2836	2664	dcom.au3	31
PID 2664 wrote to memory of 2836	2664	dcom.au3	31
PID 2664 wrote to memory of 2836	2664	dcom.au3	31
PID 2664 wrote to memory of 2836	2664	dcom.au3	31

C:\Users\Admin\AppData\Local\Temp\files\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\files\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\SysWOW64\netsh.exe
  2⤵
  - Loads dropped DLL
  - Event Triggered Execution: Netsh Helper DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Users\Admin\AppData\Local\Temp\dcom.au3
    C:\Users\Admin\AppData\Local\Temp\dcom.au3
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 148
      4⤵
      Loads dropped DLL
      Program crash
      PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9e1b9f48

Path C:\Users\Admin\AppData\Local\Temp\9e1b9f48
Size 6.8MB
SHA256 7501dc3cea0131592ce66aaad7b08982fb97eb4a76adea43d3f559c3bf3dbd75
MD5 e710a315ba6b618689d2ae7f300cb892
SHA1 41e7a9a71e2670a3dc4f5b68f616e69402c89a74
SHA512 2409683a81dfbd4d068e6343ccab24279413445594c89e32bbc99ab5b465df5d71d419f47c7eb7da3bc4121afcdab12a20b6c3d69902fdcfb1df6133aca491be
SSDEEP 196608:JARhiA48FzHfZX/FiWKsawWk614Hbm+xibw262kXi52b+n/I:4idmz/1/Fi5dB+xibw2UiTI
MD5 SHA1 SHA512 SSDEEP

Submit Download

dcom.au3

Path \Users\Admin\AppData\Local\Temp\dcom.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2116-1-0x0000000076D40000-0x0000000076EE9000-memory.dmp

Download

memory/2116-8-0x00000000740A0000-0x0000000074214000-memory.dmp

Download

memory/2116-7-0x00000000740B2000-0x00000000740B4000-memory.dmp

Download

memory/2116-9-0x00000000740A0000-0x0000000074214000-memory.dmp

Download

memory/2116-0-0x00000000740A0000-0x0000000074214000-memory.dmp

Download

memory/2664-21-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2664-22-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2664-25-0x0000000000AE0000-0x000000000122C000-memory.dmp

Download

memory/2664-34-0x0000000000AE0000-0x000000000122C000-memory.dmp

Download

memory/2960-15-0x00000000740A0000-0x0000000074214000-memory.dmp

Download

memory/2960-13-0x0000000076D40000-0x0000000076EE9000-memory.dmp

Download

memory/2960-19-0x00000000740A0000-0x0000000074214000-memory.dmp

Download

memory/2960-11-0x00000000740A0000-0x0000000074214000-memory.dmp

Download

memory/2960-23-0x00000000740A0000-0x0000000074214000-memory.dmp

Download