stealc | b09d14fbdce91d25ec9e2c680afca3ace960d85324e7639a2aa5eb70bf1ea6d2

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
##!!SetUp_2244_Pa$sW0rd$$!!/Setup.exe
Size 718.7MB
Sample240619-vjt19svalh
SHA256 fe780b0e5d8985354906e5d666614c3c6d115e8e164c489a22dcc86edf3e3e31
MD5 206f895f2048b63865a15c88c730df67
SHA1 ae225462c8ec8593fd68c3819b9e4e016e7b2a26
SHA512 25f4cc5af18ffef0bdcf668891052a62e923d04ab063013de2e784152136bc6f1b9fa38742c1cd5f0133dcefb5e250778790df6cc8ff3a08435d2c8f9828860b
SSDEEP 393216:iE4pNOK/1nm4QGsfBrqN3TQg+US6fqUsXPf1YZUT:i11nm4QGskTQgPS6f3+FMUT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc vidar stealer

Malware Config

Extracted

Family

stealc

rc4.plain

Signatures

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/2684-53-0x0000000000D90000-0x00000000014DB000-memory.dmp	family_vidar_v7
behavioral1/memory/2684-61-0x0000000000D90000-0x00000000014DB000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Loads dropped DLL 7 IoCs

pid	Process
2640	more.com
2684	CUF.au3
2636	WerFault.exe
2636	WerFault.exe
2636	WerFault.exe
2636	WerFault.exe
2636	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2596 set thread context of 2640	2596	Setup.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2636	2684	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2596	Setup.exe
2596	Setup.exe
2640	more.com
2640	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2596	Setup.exe
2640	more.com

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2640	2596	Setup.exe	28
PID 2596 wrote to memory of 2640	2596	Setup.exe	28
PID 2596 wrote to memory of 2640	2596	Setup.exe	28
PID 2596 wrote to memory of 2640	2596	Setup.exe	28
PID 2596 wrote to memory of 2640	2596	Setup.exe	28
PID 2596 wrote to memory of 2640	2596	Setup.exe	28
PID 2596 wrote to memory of 2640	2596	Setup.exe	28
PID 2596 wrote to memory of 2640	2596	Setup.exe	28
PID 2640 wrote to memory of 2684	2640	more.com	30
PID 2640 wrote to memory of 2684	2640	more.com	30
PID 2640 wrote to memory of 2684	2640	more.com	30
PID 2640 wrote to memory of 2684	2640	more.com	30
PID 2640 wrote to memory of 2684	2640	more.com	30
PID 2640 wrote to memory of 2684	2640	more.com	30
PID 2640 wrote to memory of 2684	2640	more.com	30
PID 2640 wrote to memory of 2684	2640	more.com	30
PID 2640 wrote to memory of 2684	2640	more.com	30
PID 2684 wrote to memory of 2636	2684	CUF.au3	31
PID 2684 wrote to memory of 2636	2684	CUF.au3	31
PID 2684 wrote to memory of 2636	2684	CUF.au3	31
PID 2684 wrote to memory of 2636	2684	CUF.au3	31
PID 2684 wrote to memory of 2636	2684	CUF.au3	31
PID 2684 wrote to memory of 2636	2684	CUF.au3	31
PID 2684 wrote to memory of 2636	2684	CUF.au3	31

C:\Users\Admin\AppData\Local\Temp\##!!SetUp_2244_Pa$sW0rd$$!!\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_2244_Pa$sW0rd$$!!\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Users\Admin\AppData\Local\Temp\CUF.au3
    C:\Users\Admin\AppData\Local\Temp\CUF.au3
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 252
      4⤵
      Loads dropped DLL
      Program crash
      PID:2636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

a6a8be38

Path C:\Users\Admin\AppData\Local\Temp\a6a8be38
Size 6.6MB
SHA256 e1e323fe366bf9d627070adae6e26abc29fd0d5fe421b40019376d58fbcdf93e
MD5 7e5f109992400986bc604a0bca752c67
SHA1 222cdcb35db67fd6f379ea3926dcdf7b934321ce
SHA512 d6c675bc576818960eb4ac5d8d80f1018306e982be2d3d714fc3b0564c6190a9b9c10a2096d1eb98c5685a49a5dc99a36948ae22304d14e9eac64ed17e511f39
SSDEEP 196608:sozvpBIJrU+A4DSTS/ifqDN6cxXjSQXfTTiWozZFJhcAc:dTQg+US6fqUsXPf1YZA
MD5 SHA1 SHA512 SSDEEP

Submit Download

ad94c279

Path C:\Users\Admin\AppData\Local\Temp\ad94c279
Size 6.8MB
SHA256 c5a5479178d2e60b07a46a7cea870cb4b31f87795f5c558e04cf5a41ca6fd81c
MD5 978e567c0cd877f864d7f09714ef2120
SHA1 30a4b68f01284a4a137d5385b5ba4061970ba74a
SHA512 1beb93a8916bd4dcfc85d6121b2c5f32402ef7c522d3bf44eab39a4631ecc6c33fa4a772e2f1b46d68c1c690c4f43656687460739a92cbcc9108a88eb51b5596
SSDEEP 196608:Q8X15HI8ZSJbcnZiiXDhSyyh9YG+fKcVR+9Arq:VX15HIWSiVXEh9++9j
MD5 SHA1 SHA512 SSDEEP

Submit Download

CUF.au3

Path \Users\Admin\AppData\Local\Temp\CUF.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2596-40-0x0000000073510000-0x0000000073684000-memory.dmp

Download

memory/2596-34-0x0000000073522000-0x0000000073524000-memory.dmp

Download

memory/2596-35-0x0000000073510000-0x0000000073684000-memory.dmp

Download

memory/2596-0-0x0000000000400000-0x00000000016A8000-memory.dmp

Download

memory/2596-33-0x00000000771D0000-0x0000000077379000-memory.dmp

Download

memory/2596-32-0x0000000073510000-0x0000000073684000-memory.dmp

Download

memory/2640-43-0x00000000771D0000-0x0000000077379000-memory.dmp

Download

memory/2640-45-0x0000000073510000-0x0000000073684000-memory.dmp

Download

memory/2684-51-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2684-50-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2684-53-0x0000000000D90000-0x00000000014DB000-memory.dmp

Download

memory/2684-61-0x0000000000D90000-0x00000000014DB000-memory.dmp

Download