stealc | 8bee452d2535953e7ad9d18fffacbef60560fc05647c735ef55393c0869b673d

Analysis

max time kernel
142s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 01:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
files/Setup.exe
Size 202KB
Sample240620-byeeks1enh
SHA256 c26db97858c427d92e393396f7cb7f9e7ed8f9ce616adcc123d0ec6b055b99c9
MD5 64179e64675e822559cac6652298bdfc
SHA1 cceed3b2441146762512918af7bf7f89fb055583
SHA512 ef740b35ea5190f8ee47776af1f15ebdd54d39c84da5665e64f67ae6dd0f4b181e955e9a35319a5d0bd764972562e8f2bc44dbdf83c3bedf05674eae902e7280
SSDEEP 3072:EMtKztOp6KfOQqoY3ltdNjlcwsSdplkrxf+Uyecgw:ELKfOQLY3l9jlcwnlUf+z7gw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc vidar stealer

Malware Config

Extracted

Family

stealc

rc4.plain

Signatures

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/2780-28-0x00000000006F0000-0x0000000000E3B000-memory.dmp	family_vidar_v7
behavioral1/memory/2780-35-0x00000000006F0000-0x0000000000E3B000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral1/memory/2780-28-0x00000000006F0000-0x0000000000E3B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2780-35-0x00000000006F0000-0x0000000000E3B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral1/memory/2780-28-0x00000000006F0000-0x0000000000E3B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/memory/2780-35-0x00000000006F0000-0x0000000000E3B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables containing potential Windows Defender anti-emulation checks 2 IoCs

resource	yara_rule
behavioral1/memory/2780-28-0x00000000006F0000-0x0000000000E3B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral1/memory/2780-35-0x00000000006F0000-0x0000000000E3B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2108 set thread context of 2304	2108	Setup.exe	28

Loads dropped DLL 7 IoCs

pid	Process
2304	more.com
2780	CUF.au3
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	2780	WerFault.exe	30

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Setup.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2108	Setup.exe
2108	Setup.exe
2304	more.com
2304	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2108	Setup.exe
2304	more.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2108	Setup.exe
Token: SeTakeOwnershipPrivilege	2108	Setup.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2304	2108	Setup.exe	28
PID 2108 wrote to memory of 2304	2108	Setup.exe	28
PID 2108 wrote to memory of 2304	2108	Setup.exe	28
PID 2108 wrote to memory of 2304	2108	Setup.exe	28
PID 2108 wrote to memory of 2304	2108	Setup.exe	28
PID 2304 wrote to memory of 2780	2304	more.com	30
PID 2304 wrote to memory of 2780	2304	more.com	30
PID 2304 wrote to memory of 2780	2304	more.com	30
PID 2304 wrote to memory of 2780	2304	more.com	30
PID 2304 wrote to memory of 2780	2304	more.com	30
PID 2304 wrote to memory of 2780	2304	more.com	30
PID 2780 wrote to memory of 2800	2780	CUF.au3	31
PID 2780 wrote to memory of 2800	2780	CUF.au3	31
PID 2780 wrote to memory of 2800	2780	CUF.au3	31
PID 2780 wrote to memory of 2800	2780	CUF.au3	31

C:\Users\Admin\AppData\Local\Temp\files\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\files\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Users\Admin\AppData\Local\Temp\CUF.au3
    C:\Users\Admin\AppData\Local\Temp\CUF.au3
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 148
      4⤵
      Loads dropped DLL
      Program crash
      PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8ec972f6

Path C:\Users\Admin\AppData\Local\Temp\8ec972f6
Size 6.8MB
SHA256 33e0af0e55b4072f342c53d4dcc947b9af4b4af231e6561513258018348da165
MD5 e1d87140d0b83ec4bbf66357d80962b6
SHA1 4fed77ee63c955f3fd71e57245c24a0c0d2e65ce
SHA512 7d068007443d83b0e59555da4e7794cc0313fac1f93b018a4f4c29483eea8e1eb9a604272339e6b046c3c0e63b32357ecd1543662241bcbfdc5d48fed74109cd
SSDEEP 196608:HY9aYBQ4KKYCWUJSKJqJtQ294SJn64v/mI:HY9aYBDKGZSKW8I
MD5 SHA1 SHA512 SSDEEP

Submit Download

CUF.au3

Path \Users\Admin\AppData\Local\Temp\CUF.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2108-0-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/2108-1-0x0000000076EC0000-0x0000000077069000-memory.dmp

Download

memory/2108-11-0x0000000073331000-0x0000000073343000-memory.dmp

Download

memory/2108-10-0x0000000073342000-0x0000000073344000-memory.dmp

Download

memory/2108-13-0x0000000073331000-0x0000000073343000-memory.dmp

Download

memory/2304-18-0x0000000073330000-0x00000000734A4000-memory.dmp

Download

memory/2304-16-0x0000000076EC0000-0x0000000077069000-memory.dmp

Download

memory/2304-14-0x0000000073330000-0x00000000734A4000-memory.dmp

Download

memory/2304-22-0x0000000073330000-0x00000000734A4000-memory.dmp

Download

memory/2304-26-0x0000000073330000-0x00000000734A4000-memory.dmp

Download

memory/2780-25-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2780-24-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2780-28-0x00000000006F0000-0x0000000000E3B000-memory.dmp

Download

memory/2780-35-0x00000000006F0000-0x0000000000E3B000-memory.dmp

Download