stealc | db2aa4391dc953e0f04beb01d7f25fa3e3927de6e3e83ee4f83831b7f2e83caf

Analysis

max time kernel
136s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
29/06/2024, 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

675.6MB
MD5

acc3282f8baa586c256c7c1b6ff4522c
SHA1

463d8ed383ad2a36a9df93dfefa493a2a95f4445
SHA256

2d4a3b606626c54ef71e06abab01fb69a3ff26e8c7d5322c12511e5d8bd52dc4
SHA512

e9e7321bde05e5e0f882bdd99695990dae509c24a168f017f8b83b332d350d8662e81bc380cae64730d9eeb6bccbd6a2c2a6a6aedace7a51483b4251a49ca2ed
SSDEEP

196608:i0bq45mmYPrOLaxhWJVXdgvY23Jj/W5PCtLwFRpeZApj6bZy3yIhoR0LrLBsyyS3:bbq4o3jOLaSbKY2N/6CNyRp9j6bI

Score

10^/10

stealc vidar discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

vidar

https://t.me/g067n

https://steamcommunity.com/profiles/76561199707802586

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0

Signatures

Detect Vidar Stealer 9 IoCs

stealer

resource	yara_rule
behavioral1/memory/2396-136-0x0000000001600000-0x0000000001849000-memory.dmp	family_vidar_v7
behavioral1/memory/2396-139-0x0000000001600000-0x0000000001849000-memory.dmp	family_vidar_v7
behavioral1/memory/2396-183-0x0000000001600000-0x0000000001849000-memory.dmp	family_vidar_v7
behavioral1/memory/2396-188-0x0000000001600000-0x0000000001849000-memory.dmp	family_vidar_v7
behavioral1/memory/2396-220-0x0000000001600000-0x0000000001849000-memory.dmp	family_vidar_v7
behavioral1/memory/2396-250-0x0000000001600000-0x0000000001849000-memory.dmp	family_vidar_v7
behavioral1/memory/2332-287-0x0000000000A00000-0x0000000000C49000-memory.dmp	family_vidar_v7
behavioral1/memory/2332-299-0x0000000000A00000-0x0000000000C49000-memory.dmp	family_vidar_v7
behavioral1/memory/2332-308-0x0000000000A00000-0x0000000000C49000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
704	JRWeb.exe
4240	JRWeb.exe
3212	JRWeb.exe
2136	JRWeb.exe

Loads dropped DLL 6 IoCs

pid	Process
704	JRWeb.exe
4240	JRWeb.exe
2396	VIDA.au3
3212	JRWeb.exe
2136	JRWeb.exe
2332	VIDA.au3

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4240 set thread context of 1692	4240	JRWeb.exe	81
PID 2136 set thread context of 452	2136	JRWeb.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	VIDA.au3
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	VIDA.au3
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	VIDA.au3
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	VIDA.au3

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4344	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000\Software\Microsoft\Internet Explorer\TypedURLs	Taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
244	Setup.exe
244	Setup.exe
704	JRWeb.exe
4240	JRWeb.exe
4240	JRWeb.exe
1692	more.com
1692	more.com
988	msedge.exe
988	msedge.exe
2240	msedge.exe
2240	msedge.exe
2396	VIDA.au3
2396	VIDA.au3
2396	VIDA.au3
2396	VIDA.au3
2396	VIDA.au3
2396	VIDA.au3
2312	Setup.exe
2396	VIDA.au3
2396	VIDA.au3
2312	Setup.exe
3212	JRWeb.exe
2136	JRWeb.exe
2136	JRWeb.exe
452	more.com
452	more.com
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2332	VIDA.au3
2332	VIDA.au3
2560	Taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2396	VIDA.au3
2560	Taskmgr.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4240	JRWeb.exe
1692	more.com
2136	JRWeb.exe
452	more.com

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2560	Taskmgr.exe
Token: SeSystemProfilePrivilege	2560	Taskmgr.exe
Token: SeCreateGlobalPrivilege	2560	Taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe
2560	Taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2396	VIDA.au3
2396	VIDA.au3

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 244 wrote to memory of 704	244	Setup.exe	79
PID 244 wrote to memory of 704	244	Setup.exe	79
PID 704 wrote to memory of 4240	704	JRWeb.exe	80
PID 704 wrote to memory of 4240	704	JRWeb.exe	80
PID 4240 wrote to memory of 1692	4240	JRWeb.exe	81
PID 4240 wrote to memory of 1692	4240	JRWeb.exe	81
PID 4240 wrote to memory of 1692	4240	JRWeb.exe	81
PID 4240 wrote to memory of 1692	4240	JRWeb.exe	81
PID 1692 wrote to memory of 2396	1692	more.com	84
PID 1692 wrote to memory of 2396	1692	more.com	84
PID 1692 wrote to memory of 2396	1692	more.com	84
PID 1692 wrote to memory of 2396	1692	more.com	84
PID 1692 wrote to memory of 2396	1692	more.com	84
PID 2240 wrote to memory of 2868	2240	msedge.exe	88
PID 2240 wrote to memory of 2868	2240	msedge.exe	88
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 2260	2240	msedge.exe	89
PID 2240 wrote to memory of 988	2240	msedge.exe	90
PID 2240 wrote to memory of 988	2240	msedge.exe	90
PID 2240 wrote to memory of 4568	2240	msedge.exe	91
PID 2240 wrote to memory of 4568	2240	msedge.exe	91
PID 2240 wrote to memory of 4568	2240	msedge.exe	91
PID 2240 wrote to memory of 4568	2240	msedge.exe	91
PID 2240 wrote to memory of 4568	2240	msedge.exe	91
PID 2240 wrote to memory of 4568	2240	msedge.exe	91
PID 2240 wrote to memory of 4568	2240	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:244
- C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe
  C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe
    C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Windows\SysWOW64\more.com
      C:\Windows\SysWOW64\more.com
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\VIDA.au3
        
        C:\Users\Admin\AppData\Local\Temp\VIDA.au3
        5⤵
        Loads dropped DLL
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:2396
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AEGIJKEHCAKF" & exit
        6⤵
        
        PID:812
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        Delays execution with timeout.exe
        
        PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://temp/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffe185c3cb8,0x7ffe185c3cc8,0x7ffe185c3cd8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,12045506691970760653,13403520331212911544,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,12045506691970760653,13403520331212911544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,12045506691970760653,13403520331212911544,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,12045506691970760653,13403520331212911544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,12045506691970760653,13403520331212911544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1144

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2296

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2312
- C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe
  C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3212
- - C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe
    C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2136
  - - C:\Windows\SysWOW64\more.com
      C:\Windows\SysWOW64\more.com
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:452
    - - C:\Users\Admin\AppData\Local\Temp\VIDA.au3
        
        C:\Users\Admin\AppData\Local\Temp\VIDA.au3
        5⤵
        Loads dropped DLL
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2332

C:\Windows\System32\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2560
- C:\Windows\system32\winver.exe
  "C:\Windows\system32\winver.exe"
  2⤵
  PID:5068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AEGIJKEHCAKF\DBGHDG

Filesize
64KB

MD5
ca23305ef4d62a55954792dbd2db5515

SHA1
8edb048fb64333652e2822c12eff2fa888744078

SHA256
f08f37de0b404daabed9a3628273e365e4053d26a106524ecb50c87c5770e269

SHA512
9a447dd0f9efc13d09cec9a730cd3fa6cae67bc60c2ae6177164bd2b9386561ce8b8ad05c47bc0d31d72102ecc24d7aa0c1cfb0e90d2bdc3807091836e76db7d

Download Submit
C:\ProgramData\AEGIJKEHCAKF\JECBGC

Filesize
512KB

MD5
59071590099d21dd439896592338bf95

SHA1
6a521e1d2a632c26e53b83d2cc4b0edecfc1e68c

SHA256
07854d2fef297a06ba81685e660c332de36d5d18d546927d30daad6d7fda1541

SHA512
eedb6cadbceb2c991fc6f68dccb80463b3f660c5358acd7d705398ae2e3df2b4327f0f6c6746486848bd2992b379776483a98063ae96edb45877bb0314874668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bbfb66ff6f5e565ac00d12dbb0f4113d

SHA1
8ee31313329123750487278afb3192d106752f17

SHA256
165401ef4e6bbd51cb89d3f9e6dc13a50132669d5b0229c7db12f2ec3f605754

SHA512
8ea206daabc7895923f3df9798bfd96f459bf859c78f3e5640fad550678b5090539f2a1b590883cd9797efee999acccac16d499772f61f5390e91bcc44d60560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9a91b6dd57fc9c4880d34e9e7c6b760f

SHA1
77a09da6ef4343a8b232386e000cd2d6b9fc30a3

SHA256
0170297f0103d4e415653f86dedc31b0827580042f86862206fd3f6f135b543a

SHA512
9fc3b9be931b3edebc4a6809d62d805046bdceb4c27a7db21cfbbcb0e5e253ab529c54d64e465e60904a6ab3b83156e26b97f852c9526f46f037944f806a7f0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
34b1b00982ca21b5e71ef1ea9a78d7fa

SHA1
8cfbecd721b0e005aa5f1ffc92fd405730810fe3

SHA256
41aaec399584d7b5f20bdf48d7664cc3e6dd04e237e609f82d9ba4652c8bfe03

SHA512
e12448bb441826bb41490c35ba61ce70e178d5a2ab3b556201271685bbde84cf5712f662769f87454459f1040dd02b02c74108aa8222b6f86e44bec368bf4abf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dd689358-f186-479f-8022-1844af6ae157.tmp

Filesize
5KB

MD5
ab8d2cae4410b8e3bb3507247b084e9d

SHA1
50ba616efa19a1d43f212ca91bcb36b07db72737

SHA256
f5f43b1b2ca6a4f449c1a1b4d25114d5de002479ffba4ea520e9a03243c1be7e

SHA512
1a595544a6f6f52b274b30c4cb414e36e14df0d9ba5d68b34bcc3035e251efaef472066750e43943d69669ac05d0aecd4e8dda66607d61b75b609a1ef6c16d4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fbbaab7e115d5579cb435f2c5e6bbb04

SHA1
243b54c1d943d68e6d88399ab1e8d79864198a25

SHA256
f58aba77b7c3ddd2b1330c33f6dc580418659d9ed31d2b9a1f7f252d249b7faa

SHA512
7a301e2d25389f99fb4c784d4caeb9a42c7a0c38f8b6d878534307a089bec205e5b469888c766eee982adc32adbbd4479a9573a769eb81ab5046335219c5d89d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8S54EFAG\sqlt[1].dll

Filesize
2.3MB

MD5
90e744829865d57082a7f452edc90de5

SHA1
833b178775f39675fa4e55eab1032353514e1052

SHA256
036a57102385d7f0d7b2deacf932c1c372ae30d924365b7a88f8a26657dd7550

SHA512
0a2d112ff7cb806a74f5ec17fe097d28107bb497d6ed5ad28ea47e6795434ba903cdb49aaf97a9a99c08cd0411f1969cad93031246dc107c26606a898e570323

Download Submit
C:\Users\Admin\AppData\Local\Temp\510998b7

Filesize
1.7MB

MD5
f90a3b3c91a2e1a0d2d48267d3f93c2e

SHA1
043d2071ced2d2513176cde58d5e35b5a44c5d46

SHA256
8a2edf67c6091edbc1172369a8672996c82d4e3857c992058f19f63abd058005

SHA512
66deea1e3e9fb2670f363adcf4e300376813e97b7f7474e425c522a007ce00c8b0d3a06aea603a16539dbbffb8c9d2bf8e0de143ec8891dbc910d6e1a3664d1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\VIDA.au3

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa49fd1f

Filesize
3.0MB

MD5
296aee37aa4a381e48dd9b696841c788

SHA1
9d2eb33549f04089179ce4f6b5d7ad05981401d2

SHA256
c43902f540257932cc7e61f782bf3050af5cf0f15632bc76af1e633febf4def1

SHA512
e502eecaa8936c038b53e5ebe747ce188f524a6beebac9144948604870efc9454008220ef9713ebcb2a6943114d3417c04c198c5bc02f88fb5024cbb4274d02a

Download Submit
C:\Users\Admin\AppData\Local\Temp\b2e1a1c8

Filesize
1.7MB

MD5
be02fd8bb7bb6d12bdceaca75a622be1

SHA1
d11372d105df847f65ff5093cdbf088d6bc029cc

SHA256
c9a6f3d7eb30667bac707102be5486e56491b19e917022c76c0fd7ee7c36a6c0

SHA512
f4b94d3dfacfa99525e6ee603322bc41c61c9e311c84909a225c3abfc0b55f14cd9fc344132fc08cf0e2927b7c863948f17c9f61f6b03818baf147bfdb828e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe

Filesize
1.1MB

MD5
c047ae13fc1e25bc494b17ca10aa179e

SHA1
e293c7815c0eb8fbc44d60a3e9b27bd91b44b522

SHA256
6c30c8a2e827f48fcfc934dd34fb2cb10acb8747fd11faae085d8ad352c01fbf

SHA512
0cfb96d23b043bcb954cc307f85e5bbc349c0c8a0c6eaa335ea9a8fa19ce65b047f30ed0049562d40880400d4f70e3bb28975d6970f3ae4af6da1ba06e36d48c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nodealt\WebView2Loader.dll

Filesize
157KB

MD5
4a99cb402c0d843b61a83015e0d3d731

SHA1
ac59e7722c85fef8050a715e6f4c3a3e5085d98e

SHA256
4ae3f7437a6991db64eac8e5d2fa02e9edce56ad98aaa273006963fed39548a8

SHA512
1eceb6ff5f53a98e61f21c90de9242e46c9607817eeb7ce77f500a5b225e123ac52b357c7729b334063cd8c8b37c2fbe38e76c1a5ee77244b176aa3e08d7eb18

Download Submit
C:\Users\Admin\AppData\Local\Temp\nodealt\butadiene.wav

Filesize
1.2MB

MD5
1acf3a2fc94574480aeeaa875c041521

SHA1
7d7c2e2cb200a6d79467ada52b37a4e4aea8d80b

SHA256
5c88b8bbeb0c631f7918c7e2ce9b1b7a90a84504639cf8d589d09c484625c6e2

SHA512
123b7a86e805e80a0b07606450acc474f8a20fa9475034b278043ff4cb049834738d04f8af04347c9e151b2d711f287e767d8d3a395a81ad0fd6b983dea078c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nodealt\perfidy.svg

Filesize
65KB

MD5
d7046da347cd1c24f9af82a326413734

SHA1
a8ecd6cd212e0b866ef9611bf07b6826262da0c4

SHA256
580209f46352f01b832c81a836e72d05819d33502f51bdda6212eefe0b7675d6

SHA512
cd0327dce2c68ee800e204972a88afc30b59e93847a4837fb72ddb2ee0de73e40b8e4450d7f800d50adf239ee0bdf6a1818e21c05677d1893906fc898f59c9de

Download Submit
memory/244-16-0x00007FFE256F8000-0x00007FFE256F9000-memory.dmp

Filesize
4KB

Download
memory/244-37-0x00007FFE256E0000-0x00007FFE2585A000-memory.dmp

Filesize
1.5MB

Download
memory/244-6-0x00007FFE256E0000-0x00007FFE2585A000-memory.dmp

Filesize
1.5MB

Download
memory/244-8-0x00007FFE256E0000-0x00007FFE2585A000-memory.dmp

Filesize
1.5MB

Download
memory/244-17-0x00007FFE256E0000-0x00007FFE2585A000-memory.dmp

Filesize
1.5MB

Download
memory/244-0-0x00007FF72CFE0000-0x00007FF72DE91000-memory.dmp

Filesize
14.7MB

Download
memory/452-282-0x00000000757B0000-0x000000007592D000-memory.dmp

Filesize
1.5MB

Download
memory/452-268-0x00007FFE390E0000-0x00007FFE392E9000-memory.dmp

Filesize
2.0MB

Download
memory/704-23-0x00007FFE256E0000-0x00007FFE2585A000-memory.dmp

Filesize
1.5MB

Download
memory/1692-41-0x00007FFE390E0000-0x00007FFE392E9000-memory.dmp

Filesize
2.0MB

Download
memory/1692-43-0x0000000075860000-0x00000000759DD000-memory.dmp

Filesize
1.5MB

Download
memory/2136-263-0x00007FFE29710000-0x00007FFE2988A000-memory.dmp

Filesize
1.5MB

Download
memory/2136-265-0x00007FFE29710000-0x00007FFE2988A000-memory.dmp

Filesize
1.5MB

Download
memory/2312-224-0x00007FF72CFE0000-0x00007FF72DE91000-memory.dmp

Filesize
14.7MB

Download
memory/2312-230-0x00007FFE29710000-0x00007FFE2988A000-memory.dmp

Filesize
1.5MB

Download
memory/2312-232-0x00007FFE29710000-0x00007FFE2988A000-memory.dmp

Filesize
1.5MB

Download
memory/2312-264-0x00007FFE29710000-0x00007FFE2988A000-memory.dmp

Filesize
1.5MB

Download
memory/2332-287-0x0000000000A00000-0x0000000000C49000-memory.dmp

Filesize
2.3MB

Download
memory/2332-289-0x00007FFE390E0000-0x00007FFE392E9000-memory.dmp

Filesize
2.0MB

Download
memory/2332-299-0x0000000000A00000-0x0000000000C49000-memory.dmp

Filesize
2.3MB

Download
memory/2332-308-0x0000000000A00000-0x0000000000C49000-memory.dmp

Filesize
2.3MB

Download
memory/2332-301-0x000000001A900000-0x000000001AB5F000-memory.dmp

Filesize
2.4MB

Download
memory/2396-183-0x0000000001600000-0x0000000001849000-memory.dmp

Filesize
2.3MB

Download
memory/2396-143-0x000000001B3F0000-0x000000001B64F000-memory.dmp

Filesize
2.4MB

Download
memory/2396-136-0x0000000001600000-0x0000000001849000-memory.dmp

Filesize
2.3MB

Download
memory/2396-220-0x0000000001600000-0x0000000001849000-memory.dmp

Filesize
2.3MB

Download
memory/2396-188-0x0000000001600000-0x0000000001849000-memory.dmp

Filesize
2.3MB

Download
memory/2396-138-0x00007FFE390E0000-0x00007FFE392E9000-memory.dmp

Filesize
2.0MB

Download
memory/2396-250-0x0000000001600000-0x0000000001849000-memory.dmp

Filesize
2.3MB

Download
memory/2396-139-0x0000000001600000-0x0000000001849000-memory.dmp

Filesize
2.3MB

Download
memory/2560-271-0x00000140AB210000-0x00000140AB211000-memory.dmp

Filesize
4KB

Download
memory/2560-281-0x00000140AB210000-0x00000140AB211000-memory.dmp

Filesize
4KB

Download
memory/2560-279-0x00000140AB210000-0x00000140AB211000-memory.dmp

Filesize
4KB

Download
memory/2560-278-0x00000140AB210000-0x00000140AB211000-memory.dmp

Filesize
4KB

Download
memory/2560-277-0x00000140AB210000-0x00000140AB211000-memory.dmp

Filesize
4KB

Download
memory/2560-276-0x00000140AB210000-0x00000140AB211000-memory.dmp

Filesize
4KB

Download
memory/2560-275-0x00000140AB210000-0x00000140AB211000-memory.dmp

Filesize
4KB

Download
memory/2560-280-0x00000140AB210000-0x00000140AB211000-memory.dmp

Filesize
4KB

Download
memory/2560-270-0x00000140AB210000-0x00000140AB211000-memory.dmp

Filesize
4KB

Download
memory/2560-269-0x00000140AB210000-0x00000140AB211000-memory.dmp

Filesize
4KB

Download
memory/3212-249-0x00007FFE29710000-0x00007FFE2988A000-memory.dmp

Filesize
1.5MB

Download
memory/4240-38-0x00007FFE256E0000-0x00007FFE2585A000-memory.dmp

Filesize
1.5MB

Download
memory/4240-36-0x00007FFE256E0000-0x00007FFE2585A000-memory.dmp

Filesize
1.5MB

Download
memory/4240-35-0x00007FFE256E0000-0x00007FFE2585A000-memory.dmp

Filesize
1.5MB

Download