Overview

overview

10

Static

static

3

f7d5e31a90...1d.exe

windows7-x64

10

f7d5e31a90...1d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24-09-2024 01:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f7d5e31a90a7a436fb88277e0920c9675b69fa37eee1b97120a27f792ea8ca1d.exe

  • Size

    197KB

  • MD5

    8f51409e0119d80da56d1bcddbe960b7

  • SHA1

    5ddf8d0198b0646472038f887caaee50f35f4f2e

  • SHA256

    f7d5e31a90a7a436fb88277e0920c9675b69fa37eee1b97120a27f792ea8ca1d

  • SHA512

    bafc8becd7958405e3d6ec195483d2e20bd6eb52a89845ad9fcc0351d54525d03599f66bdf0440f421e25f1ad482a2bc85eb017d8239b7525944be908af391d1

  • SSDEEP

    3072:yrsR+CX0WGYN8vWneNvsR4cByR28jzzlpcJO9hVpfCV0MY7QxFJn2IK:wsP0WGY7jR4ccfe0P7qJ2

Score
10/10
stealcvidar3a15237aa92dcd8ccca447211fb5fc2adefaultcredential_accessdiscoverypersistencespywarestealer

Malware Config

Extracted

Family

stealc

Botnet

default

C2

http://46.8.231.109

Attributes
  • url_path

    /c4754d4f680ead72.php

Extracted

Family

vidar

Version

11

Botnet

3a15237aa92dcd8ccca447211fb5fc2a

C2

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Signatures

  • Detect Vidar Stealer 12 IoCs
    stealer
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Downloads MZ/PE file
  • Drops startup file 64 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7d5e31a90a7a436fb88277e0920c9675b69fa37eee1b97120a27f792ea8ca1d.exe
    "C:\Users\Admin\AppData\Local\Temp\f7d5e31a90a7a436fb88277e0920c9675b69fa37eee1b97120a27f792ea8ca1d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2140
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminBFHDAEHDAK.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:924
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminGHIJJEGDBF.exe"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1440
        • C:\Users\AdminGHIJJEGDBF.exe
          "C:\Users\AdminGHIJJEGDBF.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1048
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2420
            • C:\ProgramData\FBFHDBKJEG.exe
              "C:\ProgramData\FBFHDBKJEG.exe"
              6⤵
              • Drops startup file
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:572
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IECBAFCAAKJD" & exit
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:960
              • C:\Windows\SysWOW64\timeout.exe
                timeout /t 10
                7⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:2272
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\RoamingIDHDGDHJEG.exe"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1472
        • C:\Users\Admin\AppData\RoamingIDHDGDHJEG.exe
          "C:\Users\Admin\AppData\RoamingIDHDGDHJEG.exe"
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:836
          • C:\Users\Admin\AppData\Local\Temp\Software\IDSM.exe
            "C:\Users\Admin\AppData\Local\Temp\Software\IDSM.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:1136
            • C:\Users\Admin\AppData\Local\Temp\Software\MSDNG.exe
              "C:\Users\Admin\AppData\Local\Temp\Software\MSDNG.exe" --checker
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

4
T1552

Credentials In Files

4
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

3
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\IECBAFCAAKJD\DAAAKF
    Filesize

    92KB

    MD5

    e248975fcae2fff4649630d9421bd44e

    SHA1

    283f382e83b0767a0cd6b2d54bce3c1c315c60d6

    SHA256

    2e7470ccd25b6d7e9606f29643dbda3e3a4ef3f0575b2d074986c80cf8b148d2

    SHA512

    9bd5cf49a7773811d72be905cc8dfc2310f82899553c6f598a52b5dc261fc26191462855fdba8b3a83c8a317faed71a1a134df83f338c6c9442ee792cdf7428f

    Download Submit

  • C:\ProgramData\IECBAFCAAKJD\IDGHDG
    Filesize

    6KB

    MD5

    642121cf3dcaa137f2eb7c4550808493

    SHA1

    52c3d2ce1521b4689dd1837542419749e32fc794

    SHA256

    cfc37007825065f71022c547b6947500091b2a274ebd609ae0c26c3b388d1137

    SHA512

    0b8a817f7edec2d45f0861d3ba461ca67aed9158dac6887321f8554837bec31510b2155ec8ceadd4b58619184a3e34c8ff7b4b6aeb0ae7d443c2879723ff2a7d

    Download Submit

  • C:\ProgramData\JJJKFBAAAF.exe
    Filesize

    162B

    MD5

    1b7c22a214949975556626d7217e9a39

    SHA1

    d01c97e2944166ed23e47e4a62ff471ab8fa031f

    SHA256

    340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

    SHA512

    ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabD155.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarD187.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Users\Admin\AppData\RoamingIDHDGDHJEG.exe
    Filesize

    410KB

    MD5

    85a11b316f726fa24547c289aa61092e

    SHA1

    b2e79c0f56b03f4213bab0b62190666e78940b82

    SHA256

    5864b9c1714f615fa1fa40f60b9e14cfb534ec217e9e4a013fa5959217adabe8

    SHA512

    4adf0998b395e502ee2d2e3ac9e58b64a537cd82a827175866522d642ec406c704665912e228f2f3e04a69d7b716da5801553dc71991f7ceac3c3b7444f13038

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IDSM_445dede795d94a50ae68f6457c7368bf.lnk
    Filesize

    1024B

    MD5

    f467645d221b554d83e50b93500a5fd8

    SHA1

    454a397a0868798b70a87c71a0b1edbce8fa09c4

    SHA256

    ba976362e1d696c50d9140330cdb4fd6bee54a3ae687c2a73510716a4f3bd2dd

    SHA512

    b41dbe6a728d82d7cfe814db5d5cb6c4b2f055c2deb3042d1ff061d656a468a6f7fba7e723a2dc166d73fd07489a21c8a5b37524d4577d3fc812e81967f36c0e

    Download Submit

  • \ProgramData\mozglue.dll
    Filesize

    593KB

    MD5

    c8fd9be83bc728cc04beffafc2907fe9

    SHA1

    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

    SHA256

    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

    SHA512

    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

    Download Submit

  • \ProgramData\nss3.dll
    Filesize

    2.0MB

    MD5

    1cc453cdf74f31e4d913ff9c10acdde2

    SHA1

    6e85eae544d6e965f15fa5c39700fa7202f3aafe

    SHA256

    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

    SHA512

    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

    Download Submit

  • \Users\AdminGHIJJEGDBF.exe
    Filesize

    403KB

    MD5

    82b844c817b508a93001bf5d7a92a16f

    SHA1

    9449fee27dee665a7ed7d144fa206889f721c87d

    SHA256

    7e31e78341d27bb711e8ac8b6867bab2f113830b6a57caea5b26f4a0771ec71f

    SHA512

    7807a0e983b1f9cdcaddc47dba93d293af2b34ff10a45d12368ae38e400d9218f0c62c5ba50f8dffe5ed4f22318080fd919edda885315cee21b338048caf3ce2

    Download Submit

  • memory/572-694-0x0000000000870000-0x000000000091A000-memory.dmp

    Filesize

    680KB

    Download

  • memory/836-132-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/836-123-0x0000000000FA0000-0x000000000104A000-memory.dmp

    Filesize

    680KB

    Download

  • memory/1048-96-0x00000000010C0000-0x0000000001128000-memory.dmp

    Filesize

    416KB

    Download

  • memory/1688-0-0x00000000740DE000-0x00000000740DF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1688-16-0x00000000740D0000-0x00000000747BE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/1688-1-0x0000000000020000-0x0000000000058000-memory.dmp

    Filesize

    224KB

    Download

  • memory/2140-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2140-21-0x0000000061E00000-0x0000000061EF3000-memory.dmp

    Filesize

    972KB

    Download

  • memory/2140-20-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/2140-19-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/2140-5-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/2140-15-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/2140-8-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/2140-9-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/2140-13-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/2140-18-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/2140-7-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/2140-3-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/2140-124-0x0000000000400000-0x0000000000643000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/2420-110-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2420-114-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2420-100-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2420-104-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2420-106-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2420-102-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2420-312-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2420-338-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2420-368-0x0000000020030000-0x000000002028F000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/2420-378-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2420-112-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2420-412-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2420-532-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2420-98-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2420-557-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2420-111-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2420-108-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/3048-203-0x00000000003B0000-0x000000000045A000-memory.dmp

    Filesize

    680KB

    Download