Automated Malware Analysis IOC Report for

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\BS4GDarWw6.exe

"C:\Users\user\Desktop\BS4GDarWw6.exe"

Details

Is windows:	true
Is dropped:	false
PID:	2972
Target ID:	0
Parent PID:	1028
Name:	BS4GDarWw6.exe
Path:	C:\Users\user\Desktop\BS4GDarWw6.exe
Commandline:	"C:\Users\user\Desktop\BS4GDarWw6.exe"
Size:	953344
MD5:	0D964DD9563668C723010679FC5C3705
Time:	23:28:27
Date:	04/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xf30000
Modulesize:	950272
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Vidar stealer	Stealing of Sensitive Information, Remote Access Functionality
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Data from Local System
Machine Learning detection for sample	AV Detection
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

Details

Is windows:	true
Is dropped:	false
PID:	6192
Target ID:	3
Parent PID:	2972
Name:	AppLaunch.exe
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
Size:	103528
MD5:	89D41E1CF478A3D3C2C701A27A5692B2
Time:	23:28:28
Date:	04/05/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x90000
Modulesize:	102400
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Vidar stealer	Stealing of Sensitive Information, Remote Access Functionality
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	5508
Target ID:	1
Parent PID:	2972
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	23:28:27
Date:	04/05/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6d64d0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://player.vimeo.com

unknown

https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=_Vry

unknown

https://steamcommunity.com/?subsection=broadcasts

unknown

http://65.108.93.119/408t

unknown

https://store.steampowered.com/subscriber_agreement/

unknown

https://www.gstatic.cn/recaptcha/

unknown

http://65.108.93.119/408923

unknown

https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6

unknown

https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl

unknown

http://65.108.93.119/408h

unknown

http://116.202.7.135/4089

unknown

http://www.valvesoftware.com/legal.htm

unknown

https://www.youtube.com

unknown

https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp

unknown

https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png

unknown

https://steamcommunity.com/login/home/?goto=profiles%2F76561199467421923

unknown

https://www.google.com

unknown

http://65.108.93.119/4083Ct

unknown

https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png

unknown

http://116.202.7.135/40823

unknown

https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english

unknown

https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&

unknown

https://steamcommunity.com/profiles/76561199467421923/badges

unknown

https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

unknown

https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english

unknown

http://65.108.93.119/ows

unknown

https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en

unknown

https://t.me/year2023starthttps://steamcommunity.com/profiles/76561199467421923http://65.108.93.119:

unknown

https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL

unknown

http://65.108.93.119/408M

unknown

https://s.ytimg.com;

unknown

https://t.me/year2023startqmJ

unknown

https://steam.tv/

unknown

http://116.202.7.135/408923

unknown

https://t.me/year2023startylrz

unknown

http://65.108.93.119:80

unknown

http://65.108.93.119/408m/

unknown

https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english

unknown

http://65.108.93.119/408tSh

unknown

http://store.steampo

unknown

https://web.telegram.org$

unknown

http://store.steampowered.com/privacy_agreement/

unknown

https://steamcommunity.com/profiles/76561199467421923

23.66.133.162

https://store.steampowered.com/points/shop/

unknown

http://116.202.7.135/

unknown

https://sketchfab.com

unknown

https://lv.queniujq.cn

unknown

https://www.youtube.com/

unknown

http://116.202.7.135/408xh

unknown

https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg

unknown

https://store.steampowered.com/privacy_agreement/

unknown

https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0

unknown

https://steamcommunity.com/profiles/76561199467421923/inventory/

unknown

http://65.108.93.119/40823

unknown

https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am

unknown

https://www.google.com/recaptcha/

unknown

http://65.108.93.119/408tkh

unknown

https://checkout.steampowered.com/

unknown

https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english

unknown

https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english

unknown

http://65.108.93.119/408Re

unknown

https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png

unknown

http://65.108.93.119/4083kt

unknown

https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis

unknown

https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC

unknown

https://store.steampowered.com/;

unknown

http://65.108.93.119:80/408

unknown

https://store.steampowered.com/about/

unknown

https://steamcommunity.com/my/wishlist/

unknown

https://t.me/

unknown

https://web.telegram.org

unknown

https://help.steampowered.com/en/

unknown

http://65.108.93.119/408tIh

unknown

https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/

unknown

https://steamcommunity.com/market/

unknown

https://store.steampowered.com/news/

unknown

https://community.akamai.steamstatic.com/

unknown

https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=roSu8uqw

unknown

http://store.steampowered.com/subscriber_agreement/

unknown

http://116.202.7.135/408

unknown

https://steamcommunity.com/Kw

unknown

https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org

unknown

https://recaptcha.net/recaptcha/;

unknown

https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en

unknown

https://steamcommunity.com/discussions/

unknown

http://116.202.7.135

unknown

https://store.steampowered.com/stats/

unknown

https://medal.tv

unknown

https://broadcast.st.dl.eccdnx.com

unknown

https://community.akamai.steamstatic.com/publd

unknown

https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1

unknown

https://store.steampowered.com/steam_refunds/

unknown

https://steamcommunity.com/workshop/

unknown

https://login.steampowered.com/

unknown

https://store.steampowered.com/legal/

unknown

https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e

unknown

http://65.108.93.119/

unknown

https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=tIrWyaxi8ABA&a

unknown

https://t.me/3j

unknown

https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv

unknown

There are 90 hidden URLs, click here to show them.

Domains

Name

Malicious

steamcommunity.com

23.66.133.162

Details

Name:	steamcommunity.com
IP:	23.66.133.162
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Snort IDS alert for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found strings which match to known social media urls	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

t.me

149.154.167.99

Details

Name:	t.me
IP:	149.154.167.99
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

IPs

Domain

Country

Malicious

116.202.7.135

unknown

Germany

Details

IP:	116.202.7.135
TargetID:	3
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Country:	Germany
Countrycode:	DEU
ASN number:	24940
ASN name:	HETZNER-ASDE
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking
URLs found in memory or binary data	Networking

65.108.93.119

unknown

United States

Details

IP:	65.108.93.119
TargetID:	3
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Country:	United States
Countrycode:	USA
ASN number:	11022
ASN name:	ALABANZA-BALTUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

23.66.133.162

steamcommunity.com

United States

Details

IP:	23.66.133.162
TargetID:	3
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Country:	United States
Countrycode:	USA
ASN number:	16625
ASN name:	AKAMAI-ASUS
Private:	false
Domain:	steamcommunity.com

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

149.154.167.99

t.me

United Kingdom

Details

IP:	149.154.167.99
TargetID:	3
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Country:	United Kingdom
Countrycode:	GBR
ASN number:	62041
ASN name:	TELEGRAMRU
Private:	false
Domain:	t.me

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Memdumps

Base Address

Regiontype

Protect

Malicious

FC8000

unkown

page write copy

FC7000

unkown

page write copy

436000

remote allocation

page readonly

16D0000

direct allocation

page execute and read and write

E90000

heap

page read and write

4D2B000

heap

page read and write

660EF000

stack

page read and write

11B0000

heap

page read and write

48F7000

stack

page read and write

4D2E000

heap

page read and write

4C50000

heap

page read and write

15CF000

stack

page read and write

445000

remote allocation

page read and write

663AF000

stack

page read and write

65E5E000

stack

page read and write

6610000

heap

page read and write

F31000

unkown

page execute read

1013000

unkown

page readonly

49D0000

heap

page readonly

48F9000

stack

page read and write

4D20000

heap

page read and write

4C9D000

heap

page read and write

F30000

unkown

page readonly

401000

remote allocation

page execute read

1840000

heap

page read and write

4AE5000

heap

page read and write

66540000

heap

page read and write

65FEE000

stack

page read and write

EDE000

stack

page read and write

F31000

unkown

page execute read

4D29000

heap

page read and write

106E000

heap

page read and write

4A60000

heap

page read and write

6626D000

stack

page read and write

662AE000

stack

page read and write

6652F000

stack

page read and write

E80000

heap

page read and write

6650000

heap

page read and write

1011000

unkown

page read and write

4D36000

heap

page read and write

45F0000

heap

page read and write

45B000

remote allocation

page readonly

1060000

heap

page read and write

6616E000

stack

page read and write

458C000

stack

page read and write

4CC2000

heap

page read and write

D2D000

stack

page read and write

65E9D000

stack

page read and write

F1E000

stack

page read and write

4CB7000

heap

page read and write

65F0000

heap

page read and write

65F9E000

stack

page read and write

FA1000

unkown

page readonly

F30000

unkown

page readonly

172B000

direct allocation

page execute and read and write

16CF000

stack

page read and write

E2D000

stack

page read and write

4AE0000

heap

page read and write

4CA3000

heap

page read and write

106A000

heap

page read and write

65D5D000

stack

page read and write

1013000

unkown

page readonly

65D1F000

stack

page read and write

400000

remote allocation

page readonly

FA1000

unkown

page readonly

FC7000

unkown

page execute and read and write

65C1E000

stack

page read and write

6642E000

stack

page read and write

4C58000

heap

page read and write

There are 59 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
BS4GDarWw6

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportBS4GDarWw6

Processes

URLs

Domains

IPs

Memdumps

IOC Report
BS4GDarWw6