stealc | d9d3d28b7eaeb8602a9e8d2a98d3f48b5f318f4123b637556048bd1e93028f54

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/06/2024, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
#^NeW_PcSetUp_6677_PaS?K?Y#$/Setup.exe
Size 293KB
Sample240621-d9mansxdph
SHA256 63ec17feda1f0ea80e0dd7b7938fbf7354aedf8d9f4041543afca9a35337f7bf
MD5 d9602ab0e6370519bd54d13d22dd6ef5
SHA1 95a3a7afdb00e1b2a99fddfe5d3203aa5cd4a09d
SHA512 4587ca630bf5e421e48d5ac7f9ac6866000b06a99d89c1ca31c999414a63ba06a6be2e11467c045b0e2cddb21d792342e69977e6abda6e265b91044e2c8007cd
SSDEEP 6144:jFnHaRGVUA2LOPQNk1Ekle0SnYBV+MiySwq+Q+KxwpwF1oPOmYjeTV4jog:ZnHaRPKIk1Ekle0SQq+Q+OwpwnV4g
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc vidar stealer

Malware Config

Extracted

Family

stealc

rc4.plain

Signatures

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/2504-23-0x00000000006D0000-0x0000000000E1B000-memory.dmp	family_vidar_v7
behavioral1/memory/2504-30-0x00000000006D0000-0x0000000000E1B000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Loads dropped DLL 7 IoCs

pid	Process
3000	more.com
2504	CUF.au3
2704	WerFault.exe
2704	WerFault.exe
2704	WerFault.exe
2704	WerFault.exe
2704	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2196 set thread context of 3000	2196	Setup.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	2504	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2196	Setup.exe
2196	Setup.exe
3000	more.com
3000	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2196	Setup.exe
3000	more.com

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 3000	2196	Setup.exe	28
PID 2196 wrote to memory of 3000	2196	Setup.exe	28
PID 2196 wrote to memory of 3000	2196	Setup.exe	28
PID 2196 wrote to memory of 3000	2196	Setup.exe	28
PID 2196 wrote to memory of 3000	2196	Setup.exe	28
PID 3000 wrote to memory of 2504	3000	more.com	30
PID 3000 wrote to memory of 2504	3000	more.com	30
PID 3000 wrote to memory of 2504	3000	more.com	30
PID 3000 wrote to memory of 2504	3000	more.com	30
PID 3000 wrote to memory of 2504	3000	more.com	30
PID 3000 wrote to memory of 2504	3000	more.com	30
PID 2504 wrote to memory of 2704	2504	CUF.au3	31
PID 2504 wrote to memory of 2704	2504	CUF.au3	31
PID 2504 wrote to memory of 2704	2504	CUF.au3	31
PID 2504 wrote to memory of 2704	2504	CUF.au3	31

C:\Users\Admin\AppData\Local\Temp\#^NeW_PcSetUp_6677_PaS_K_Y#$\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\#^NeW_PcSetUp_6677_PaS_K_Y#$\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Users\Admin\AppData\Local\Temp\CUF.au3
    C:\Users\Admin\AppData\Local\Temp\CUF.au3
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 148
      4⤵
      Loads dropped DLL
      Program crash
      PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

9a29e55e

Path C:\Users\Admin\AppData\Local\Temp\9a29e55e
Size 6.8MB
SHA256 77d30aa7db09c948f32d14b535b3e583cbc9c8924632d9de8fd0bb992752a982
MD5 a85e6405c11a5969d09749d27e10f096
SHA1 f6149e437ab43ad915e682fbbcd37fdd905a0428
SHA512 1675bb0d0daf9a226090487232e835e4e382cb26800ecc550af8dc07a1e7d1c0663cc95af9954e6a9ed21a3a1f31aa9b755b65b015406f0cf91acd7e95e67c64
SSDEEP 196608:JnSom9kkMzAl2UN2Ius28paDtS94xaIvQyEE0Gc:u9nMAj3wZtSKaIqE0Gc
MD5 SHA1 SHA512 SSDEEP

Submit Download

CUF.au3

Path \Users\Admin\AppData\Local\Temp\CUF.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2196-1-0x00000000770F0000-0x0000000077299000-memory.dmp

Download

memory/2196-6-0x00000000743C0000-0x0000000074534000-memory.dmp

Download

memory/2196-5-0x00000000743D2000-0x00000000743D4000-memory.dmp

Download

memory/2196-7-0x00000000743C0000-0x0000000074534000-memory.dmp

Download

memory/2196-0-0x00000000743C0000-0x0000000074534000-memory.dmp

Download

memory/2504-19-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2504-20-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2504-23-0x00000000006D0000-0x0000000000E1B000-memory.dmp

Download

memory/2504-30-0x00000000006D0000-0x0000000000E1B000-memory.dmp

Download

memory/3000-13-0x00000000743C0000-0x0000000074534000-memory.dmp

Download

memory/3000-14-0x00000000743C0000-0x0000000074534000-memory.dmp

Download

memory/3000-11-0x00000000770F0000-0x0000000077299000-memory.dmp

Download

memory/3000-9-0x00000000743C0000-0x0000000074534000-memory.dmp

Download

memory/3000-21-0x00000000743C0000-0x0000000074534000-memory.dmp

Download