Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 12:19
General
- Target 2026-05-11_4af384a07aec897598b5fffb21a9ebe0_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
- Size 3.3MB
- Sample260511-phcspshx2x
- SHA256 56904638ff35e22ea79b73ba98d7c27e8500a5430121a1b04bcb56a24accd80b
Malware Config
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Vidar Stealer 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_4af384a07aec897598b5fffb21a9ebe0_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_4af384a07aec897598b5fffb21a9ebe0_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Z47816996\build.exe"C:\Users\Admin\AppData\Roaming\Z47816996\build.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\Z47816996\profi2703_arcl_9cr120.exe"C:\Users\Admin\AppData\Roaming\Z47816996\profi2703_arcl_9cr120.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C move "profi2703_arcl_9cr120.exe" C:\Users\Admin\AppData\Roaming\cermn.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \System\SecurityService /tr %userprofile%\AppData\Roaming\cermn.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \System\SecurityService /tr C:\Users\Admin\AppData\Roaming\cermn.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x49c 0x4e81⤵
-
C:\Users\Admin\AppData\Roaming\cermn.exeC:\Users\Admin\AppData\Roaming\cermn.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\cermn.exeC:\Users\Admin\AppData\Roaming\cermn.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\cermn.exeC:\Users\Admin\AppData\Roaming\cermn.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cermn.exe.log
build.exe
profi2703_arcl_9cr120.exe
memory/1036-43-0x0000000002380000-0x00000000023FE000-memory.dmp
memory/1328-35-0x0000000002710000-0x000000000278E000-memory.dmp
memory/2944-25-0x00000000009F0000-0x0000000000D54000-memory.dmp
memory/2944-26-0x00000000049E0000-0x0000000004A5E000-memory.dmp
memory/3596-29-0x00000000199F0000-0x0000000019A0A000-memory.dmp
memory/3596-30-0x000000001C100000-0x000000001C6A4000-memory.dmp
memory/3596-31-0x000000001BF80000-0x000000001C012000-memory.dmp
memory/3596-28-0x0000000002380000-0x00000000023FE000-memory.dmp
memory/3596-36-0x0000000000400000-0x00000000004AB000-memory.dmp
memory/4544-27-0x00000000020A0000-0x000000000211E000-memory.dmp
memory/4628-63-0x0000000002720000-0x000000000279E000-memory.dmp