Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 12:19
General
- Target 2026-05-11_4af384a07aec897598b5fffb21a9ebe0_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
- Size 3.3MB
- Sample260511-phcspshx2x
- SHA256 56904638ff35e22ea79b73ba98d7c27e8500a5430121a1b04bcb56a24accd80b
Malware Config
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Vidar Stealer 1 IoCs
- Executes dropped EXE 5 IoCs
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_4af384a07aec897598b5fffb21a9ebe0_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_4af384a07aec897598b5fffb21a9ebe0_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Z47816996\build.exe"C:\Users\Admin\AppData\Roaming\Z47816996\build.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\Z47816996\profi2703_arcl_9cr120.exe"C:\Users\Admin\AppData\Roaming\Z47816996\profi2703_arcl_9cr120.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C move "profi2703_arcl_9cr120.exe" C:\Users\Admin\AppData\Roaming\cermn.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \System\SecurityService /tr %userprofile%\AppData\Roaming\cermn.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \System\SecurityService /tr C:\Users\Admin\AppData\Roaming\cermn.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004D41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\cermn.exeC:\Users\Admin\AppData\Roaming\cermn.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\cermn.exeC:\Users\Admin\AppData\Roaming\cermn.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\cermn.exeC:\Users\Admin\AppData\Roaming\cermn.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cermn.exe.log
build.exe
profi2703_arcl_9cr120.exe
memory/1724-26-0x0000000001200000-0x00000000012BB000-memory.dmp
memory/1724-25-0x00000000007A0000-0x0000000000B04000-memory.dmp
memory/2692-91-0x00000000006D0000-0x000000000078B000-memory.dmp
memory/2692-28-0x0000000002EA0000-0x0000000002EA7000-memory.dmp
memory/2692-27-0x00000000006D0000-0x000000000078B000-memory.dmp
memory/2692-55-0x00000000006D0000-0x000000000078B000-memory.dmp
memory/3376-76-0x00000000009B0000-0x0000000000A6B000-memory.dmp
memory/4396-50-0x0000000000A20000-0x0000000000ADB000-memory.dmp
memory/4448-38-0x0000000000400000-0x00000000004AB000-memory.dmp
memory/4448-39-0x0000000000B60000-0x0000000000C1B000-memory.dmp
memory/4448-43-0x0000000000B60000-0x0000000000C1B000-memory.dmp
memory/4448-32-0x000000001C060000-0x000000001C0F2000-memory.dmp
memory/4448-31-0x000000001C170000-0x000000001C716000-memory.dmp
memory/4448-58-0x0000000000B60000-0x0000000000C1B000-memory.dmp
memory/4448-30-0x0000000019B80000-0x0000000019B9A000-memory.dmp
memory/4448-29-0x0000000000B60000-0x0000000000C1B000-memory.dmp
memory/4448-98-0x0000000000B60000-0x0000000000C1B000-memory.dmp
memory/4768-35-0x00000000008E0000-0x000000000099B000-memory.dmp