stealc | b09d14fbdce91d25ec9e2c680afca3ace960d85324e7639a2aa5eb70bf1ea6d2

Analysis

max time kernel
144s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
##!!SetUp_2244_Pa$sW0rd$$!!/Setup.exe
Size 718.7MB
Sample240619-vjt19svalh
SHA256 fe780b0e5d8985354906e5d666614c3c6d115e8e164c489a22dcc86edf3e3e31
MD5 206f895f2048b63865a15c88c730df67
SHA1 ae225462c8ec8593fd68c3819b9e4e016e7b2a26
SHA512 25f4cc5af18ffef0bdcf668891052a62e923d04ab063013de2e784152136bc6f1b9fa38742c1cd5f0133dcefb5e250778790df6cc8ff3a08435d2c8f9828860b
SSDEEP 393216:iE4pNOK/1nm4QGsfBrqN3TQg+US6fqUsXPf1YZUT:i11nm4QGskTQgPS6f3+FMUT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc vidar discovery spyware stealer

Malware Config

Extracted

Family

stealc

rc4.plain

Signatures

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/60-27-0x0000000001200000-0x000000000194B000-memory.dmp	family_vidar_v7
behavioral2/memory/60-42-0x0000000001200000-0x000000000194B000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	CUF.au3

Loads dropped DLL 1 IoCs

pid	Process
60	CUF.au3

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4828 set thread context of 1476	4828	Setup.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	CUF.au3

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
528	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4828	Setup.exe
4828	Setup.exe
1476	more.com
1476	more.com
60	CUF.au3
60	CUF.au3

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4828	Setup.exe
1476	more.com

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 1476	4828	Setup.exe	85
PID 4828 wrote to memory of 1476	4828	Setup.exe	85
PID 4828 wrote to memory of 1476	4828	Setup.exe	85
PID 4828 wrote to memory of 1476	4828	Setup.exe	85
PID 1476 wrote to memory of 60	1476	more.com	87
PID 1476 wrote to memory of 60	1476	more.com	87
PID 1476 wrote to memory of 60	1476	more.com	87
PID 1476 wrote to memory of 60	1476	more.com	87
PID 1476 wrote to memory of 60	1476	more.com	87
PID 60 wrote to memory of 5092	60	CUF.au3	90
PID 60 wrote to memory of 5092	60	CUF.au3	90
PID 60 wrote to memory of 5092	60	CUF.au3	90
PID 5092 wrote to memory of 528	5092	cmd.exe	92
PID 5092 wrote to memory of 528	5092	cmd.exe	92
PID 5092 wrote to memory of 528	5092	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\##!!SetUp_2244_Pa$sW0rd$$!!\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\##!!SetUp_2244_Pa$sW0rd$$!!\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Users\Admin\AppData\Local\Temp\CUF.au3
    C:\Users\Admin\AppData\Local\Temp\CUF.au3
    3⤵
    - Checks computer location settings
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:60
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\CUF.au3" & rd /s /q "C:\ProgramData\JJKJDAEBFCBK" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5092
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

115c3ce

Path C:\Users\Admin\AppData\Local\Temp\115c3ce
Size 6.6MB
SHA256 e1e323fe366bf9d627070adae6e26abc29fd0d5fe421b40019376d58fbcdf93e
MD5 7e5f109992400986bc604a0bca752c67
SHA1 222cdcb35db67fd6f379ea3926dcdf7b934321ce
SHA512 d6c675bc576818960eb4ac5d8d80f1018306e982be2d3d714fc3b0564c6190a9b9c10a2096d1eb98c5685a49a5dc99a36948ae22304d14e9eac64ed17e511f39
SSDEEP 196608:sozvpBIJrU+A4DSTS/ifqDN6cxXjSQXfTTiWozZFJhcAc:dTQg+US6fqUsXPf1YZA
MD5 SHA1 SHA512 SSDEEP

Submit Download

5bcf107

Path C:\Users\Admin\AppData\Local\Temp\5bcf107
Size 6.8MB
SHA256 de010cdda7f00db67d9a949a5fac3bad14ff99f615741bb50a7bdd0980ae521f
MD5 b6e4ee87029c71998d85e80b58dc9fe3
SHA1 f8258ebc01b03497f73296e929e1844ed47c3388
SHA512 a24b79fcff6e0cb3d5a8bf531969d975874a0ebffcd53a5818a4cba37844ef741ef511b34be73385cc7bfa0cb6e6dda678da5866b4dcea428a9f89828efe74b7
SSDEEP 98304:scfxFZ4k8pV5hkTTzAwmDYL6KHnO+lgMeRV4l34DxA6Wa086VuA6LQxsecYPYHTD:scJF0pkWYn7lgMeRV+6xAZ86wlZwu/qW
MD5 SHA1 SHA512 SSDEEP

Submit Download

CUF.au3

Path C:\Users\Admin\AppData\Local\Temp\CUF.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-42-0x0000000001200000-0x000000000194B000-memory.dmp

Download

memory/60-30-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/60-29-0x00007FFF85090000-0x00007FFF85285000-memory.dmp

Download

memory/60-27-0x0000000001200000-0x000000000194B000-memory.dmp

Download

memory/1476-17-0x00007FFF85090000-0x00007FFF85285000-memory.dmp

Download

memory/1476-19-0x0000000073090000-0x000000007320B000-memory.dmp

Download

memory/1476-21-0x0000000073090000-0x000000007320B000-memory.dmp

Download

memory/1476-25-0x0000000073090000-0x000000007320B000-memory.dmp

Download

memory/1476-15-0x0000000073090000-0x000000007320B000-memory.dmp

Download

memory/4828-2-0x00000000001F0000-0x0000000001498000-memory.dmp

Download

memory/4828-14-0x0000000073091000-0x00000000730A3000-memory.dmp

Download

memory/4828-12-0x0000000073091000-0x00000000730A3000-memory.dmp

Download

memory/4828-11-0x00000000730A2000-0x00000000730A4000-memory.dmp

Download

memory/4828-10-0x00007FFF85090000-0x00007FFF85285000-memory.dmp

Download