stealc | c63d002506855885ef330524e7284a9c4b01ddb78f05db74f2dbfe6ab905190d

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 19.8MB
Sample240628-sdaz4avejc
SHA256 c63d002506855885ef330524e7284a9c4b01ddb78f05db74f2dbfe6ab905190d
MD5 1e7360d144db1f0ff44b48114b1ff6b4
SHA1 e164a928226fc54535707069fee7f82b7a5b57cd
SHA512 f79aee721d7802c5aafbaf52e59a19f3360f00b6f3518f7daa99569118fcf7700c4aaba04a6398c1a7c2be4332bb83e19caaff3f1f7c50c9a7b460d77f5bfd6a
SSDEEP 196608:30bq45mmYPrOLaxhcFecFNOkX/Roslbo9KLD1B8NAJFq0eHH+tNJKAXkZ:kbq4o3jOLaeFDoCbL8NAJQ0e+tNUsk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc vidar discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

vidar

https://aliszon.xyz
https://t.me/g067n
https://steamcommunity.com/profiles/76561199707802586

Attributes

user_agent
Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/8.0.500.0 Safari/534.6

Signatures

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/memory/3484-57-0x0000000000A00000-0x000000000114B000-memory.dmp	family_vidar_v7
behavioral2/memory/3484-61-0x0000000000A00000-0x000000000114B000-memory.dmp	family_vidar_v7
behavioral2/memory/3484-74-0x0000000000A00000-0x000000000114B000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Launcher32.exe

Executes dropped EXE 3 IoCs

pid	Process
4056	JRWeb.exe
4788	JRWeb.exe
2692	Setup.exe

Loads dropped DLL 3 IoCs

pid	Process
4056	JRWeb.exe
4788	JRWeb.exe
3484	Launcher32.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4788 set thread context of 4664	4788	JRWeb.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1784	2692	WerFault.exe	82

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Launcher32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Launcher32.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
456	timeout.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
232	Setup.exe
232	Setup.exe
4056	JRWeb.exe
4788	JRWeb.exe
4788	JRWeb.exe
4664	more.com
4664	more.com
3484	Launcher32.exe
3484	Launcher32.exe
3484	Launcher32.exe
3484	Launcher32.exe
3484	Launcher32.exe
3484	Launcher32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4788	JRWeb.exe
4664	more.com

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 4056	232	Setup.exe	80
PID 232 wrote to memory of 4056	232	Setup.exe	80
PID 4056 wrote to memory of 4788	4056	JRWeb.exe	81
PID 4056 wrote to memory of 4788	4056	JRWeb.exe	81
PID 4788 wrote to memory of 2692	4788	JRWeb.exe	82
PID 4788 wrote to memory of 2692	4788	JRWeb.exe	82
PID 4788 wrote to memory of 2692	4788	JRWeb.exe	82
PID 4788 wrote to memory of 4664	4788	JRWeb.exe	86
PID 4788 wrote to memory of 4664	4788	JRWeb.exe	86
PID 4788 wrote to memory of 4664	4788	JRWeb.exe	86
PID 4788 wrote to memory of 4664	4788	JRWeb.exe	86
PID 4664 wrote to memory of 3484	4664	more.com	88
PID 4664 wrote to memory of 3484	4664	more.com	88
PID 4664 wrote to memory of 3484	4664	more.com	88
PID 4664 wrote to memory of 3484	4664	more.com	88
PID 3484 wrote to memory of 3604	3484	Launcher32.exe	94
PID 3484 wrote to memory of 3604	3484	Launcher32.exe	94
PID 3484 wrote to memory of 3604	3484	Launcher32.exe	94
PID 3604 wrote to memory of 456	3604	cmd.exe	96
PID 3604 wrote to memory of 456	3604	cmd.exe	96
PID 3604 wrote to memory of 456	3604	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:232
- C:\Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe
  C:\Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Users\Admin\AppData\Roaming\Hq_Control\JRWeb.exe
    C:\Users\Admin\AppData\Roaming\Hq_Control\JRWeb.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Users\Admin\AppData\Roaming\Hq_Control\VRGMYZSSRACXVEJAQJ\Setup.exe
      C:\Users\Admin\AppData\Roaming\Hq_Control\VRGMYZSSRACXVEJAQJ\Setup.exe
      4⤵
      Executes dropped EXE
      PID:2692
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 880
        5⤵
        Program crash
        
        PID:1784
  - - C:\Windows\SysWOW64\more.com
      C:\Windows\SysWOW64\more.com
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Launcher32.exe
        
        C:\Users\Admin\AppData\Local\Temp\Launcher32.exe
        5⤵
        Checks computer location settings
        Loads dropped DLL
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3484
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Launcher32.exe" & rd /s /q "C:\ProgramData\BFIDGHDBAFIJ" & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3604
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        Delays execution with timeout.exe
        
        PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 2692 -ip 2692
1⤵
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JRWeb.exe

Path C:\Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe
Size 1.1MB
SHA256 6c30c8a2e827f48fcfc934dd34fb2cb10acb8747fd11faae085d8ad352c01fbf
MD5 c047ae13fc1e25bc494b17ca10aa179e
SHA1 e293c7815c0eb8fbc44d60a3e9b27bd91b44b522
SHA512 0cfb96d23b043bcb954cc307f85e5bbc349c0c8a0c6eaa335ea9a8fa19ce65b047f30ed0049562d40880400d4f70e3bb28975d6970f3ae4af6da1ba06e36d48c
SSDEEP 12288:a9hZPq27B7+x3dPC4gvgdVwTzDxsVyY4YoUwpf5kpRG6xsfJAYo2R0B5YD5sW91A:STS27B7+x3E4tdS/Dxkd4YoDfZ90gLS
MD5 SHA1 SHA512 SSDEEP

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\Hq_Control\WebView2Loader.dll
Size 157KB
SHA256 4ae3f7437a6991db64eac8e5d2fa02e9edce56ad98aaa273006963fed39548a8
MD5 4a99cb402c0d843b61a83015e0d3d731
SHA1 ac59e7722c85fef8050a715e6f4c3a3e5085d98e
SHA512 1eceb6ff5f53a98e61f21c90de9242e46c9607817eeb7ce77f500a5b225e123ac52b357c7729b334063cd8c8b37c2fbe38e76c1a5ee77244b176aa3e08d7eb18
SSDEEP 3072:dr0B+bUXT4UPcGE91jkXmxyu1A14mRgo8JzeTIJEtcuVux4WurbzQrTvhr:djgj4UPBE9dGvW9mRmEtc+FLDWh
MD5 SHA1 SHA512 SSDEEP

Submit Download

butadiene.wav

Path C:\Users\Admin\AppData\Local\Temp\Hq_Control\butadiene.wav
Size 6.2MB
SHA256 09ff3222b2598b793f7081f8c3c20fe071b45cbdba1982997f1ae9c05c20957c
MD5 67aff9151292ba13adbbdbe84bef05fe
SHA1 c2766299f21528bdf1593ed4f849df1df1b10642
SHA512 a67122d5880dcd411a1143ba76d75604c592018bc90959360ac995b127c7204c93a68815ba823411d6b5e2ae961f76f7b9e6e11e4a572fe7b5aae598e4ff098a
SSDEEP 98304:/Y8/B/XJcypa0CmzBdwI1AIo7Qds/g/ZQ7dzMIL5iWSOLgxhnXH8P3jOumF:/Y8p5ZZ51+7Qds6KMOcWyxh3KCF
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfidy.svg

Path C:\Users\Admin\AppData\Local\Temp\Hq_Control\perfidy.svg
Size 65KB
SHA256 580209f46352f01b832c81a836e72d05819d33502f51bdda6212eefe0b7675d6
MD5 d7046da347cd1c24f9af82a326413734
SHA1 a8ecd6cd212e0b866ef9611bf07b6826262da0c4
SHA512 cd0327dce2c68ee800e204972a88afc30b59e93847a4837fb72ddb2ee0de73e40b8e4450d7f800d50adf239ee0bdf6a1818e21c05677d1893906fc898f59c9de
SSDEEP 1536:6bRFkD3NfbPK7VCUaPlm4M3V+J3X3qAeF3dCPVaGrQWKf/BHI:6bRF0dfToCUatm4S+9Y4P4Gr2Zo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Launcher32.exe

Path C:\Users\Admin\AppData\Local\Temp\Launcher32.exe
Size 994KB
SHA256 6e599490e164505af796569dce30e18218b179b2b791fe69764892b3ed3e7478
MD5 de0ea31558536ca7e3164c3cd4578bf5
SHA1 5cc890c3ade653bb1ed1e53dabb0410602ee52df
SHA512 c47299cd5f3b4961f423c2ca1fef5a33eb4b0f63dc232af70ef9da39f6f82270406061dd543461de7e47abd1244e26d6190de6035120211b27d4c23f97a25aba
SSDEEP 24576:eZwu3kI1OqRsSLJG+tr4mr08m5GV1eFSxdRMfJs:w/3DUqRLJGLQwGVQSxdRMfJs
MD5 SHA1 SHA512 SSDEEP

Submit Download

dfa2cb22

Path C:\Users\Admin\AppData\Local\Temp\dfa2cb22
Size 8.2MB
SHA256 4f60f0dfbfc9671763edd75f3d0ff83b2782c3cf0ee15531f27890cf42ab0028
MD5 9b97e0eeeb2c72848b8364571aa3bea6
SHA1 a976cd15348f6caa5b013d16c7bfb89973601686
SHA512 62ee1d713aed80a8f7282fc9f86c05f4e9be202de8b356728b467b264d7a2715e4cf80ece8a2334f0440834bcf39407dd5fd48a097e5add612e1260a7d54e9c1
SSDEEP 196608:becFNOkX/Roslbo9KLD1B8NAJFq0eHH+tNJKAXQ:bFDoCbL8NAJQ0e+tNUsQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

eedb1925

Path C:\Users\Admin\AppData\Local\Temp\eedb1925
Size 7.0MB
SHA256 220577f26d4ae8da5a6affc0a23705cd227d22a9d2c875cd818a9b9736b87f59
MD5 fb9ffdb066080a1e24bd1876aff23e0a
SHA1 0893bd90254f32e0d4d454f8b185c60389bd469f
SHA512 1de9848f2ff4cd316e3ca84a2255f65397546e65fd5f887731e56197f03a351916df5386211b1c86bcba02bc29861e38ba437c8f470f0bbbb8a3a9c8293d8dab
SSDEEP 98304:ZYAv4NNeu3Bs/eFwUqH6JfssEl8l4Z838EpIzC++S6/7grzc788C5DgIUK5Ka:2MwYuy2FgHGfEl8yZ838L4qI7IBP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Roaming\Hq_Control\VRGMYZSSRACXVEJAQJ\Setup.exe
Size 111KB
SHA256 56cff82b9e3ee0ed5e74a3e55115e96fd198598be26492cca7b15d9b9023a238
MD5 9f262921a7fbd432c3a694a372caf1b9
SHA1 dfd75a8835a5553d457f4f702c7fe5785227854f
SHA512 cabeaef6132444dc06e7a53332eb58446f7046069044c44b7a27693866a1d66aad7b3ebb5fe7bb79b780548a75b206528f176f5505c574b1c7ad3bcc6fc628b8
SSDEEP 1536:EDDx7Upqno3LbIGHP50vttPTHQaictCH5p5A5stCpnchYq9o:yx7UYno3v50vjzHY5p5A5stC9chYqm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/232-14-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

Download

memory/232-13-0x00007FFA0EEE8000-0x00007FFA0EEE9000-memory.dmp

Download

memory/232-8-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

Download

memory/232-18-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

Download

memory/232-0-0x00007FF6BF560000-0x00007FF6C094E000-memory.dmp

Download

memory/232-6-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

Download

memory/232-17-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

Download

memory/232-44-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

Download

memory/3484-57-0x0000000000A00000-0x000000000114B000-memory.dmp

Download

memory/3484-61-0x0000000000A00000-0x000000000114B000-memory.dmp

Download

memory/3484-62-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/3484-74-0x0000000000A00000-0x000000000114B000-memory.dmp

Download

memory/3484-56-0x00007FFA1DB70000-0x00007FFA1DD65000-memory.dmp

Download

memory/4056-25-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

Download

memory/4664-51-0x0000000074B60000-0x0000000074CDB000-memory.dmp

Download

memory/4664-49-0x00007FFA1DB70000-0x00007FFA1DD65000-memory.dmp

Download

memory/4788-45-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

Download

memory/4788-40-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

Download

memory/4788-39-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

Download

memory/4788-37-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

Download