File name:

7db84b78d72db876698cda4ea74a9c90.exe

Full analysis: https://app.any.run/tasks/ecc184f6-d970-4088-925f-98270dbad0b4
Verdict: Malicious activity
Threats:

Stealc is a stealer malware that targets victims’ sensitive data, which it exfiltrates from browsers, messaging apps, and other software. The malware is equipped with advanced features, including fingerprinting, control panel, evasion mechanisms, string obfuscation, etc. Stealc establishes persistence and communicates with its C2 server through HTTP POST requests.

Analysis date: March 24, 2025, 16:53:43
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
telegram
vidar
stealer
stealc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

7DB84B78D72DB876698CDA4EA74A9C90

SHA1:

FBEB7CE7F9B992A7FB9C3A54F4EBB8E891752FA7

SHA256:

778723A999D44E9FCD6C0D2827F09C404C2700BFE61E151779B44405889256E3

SSDEEP:

98304:WrvhjCF5Qzm2lHxhF5h8upS2eYkrch0qXi0tOXIRMUwMeCzX4JIHyQ7dyQIgvpIY:DwAt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • VIDAR mutex has been found

      • 7db84b78d72db876698cda4ea74a9c90.exe (PID: 7448)
  • SUSPICIOUS

    • Reads the BIOS version

      • 7db84b78d72db876698cda4ea74a9c90.exe (PID: 7448)
    • Reads security settings of Internet Explorer

      • 7db84b78d72db876698cda4ea74a9c90.exe (PID: 7448)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • 7db84b78d72db876698cda4ea74a9c90.exe (PID: 7448)
  • INFO

    • Creates files in the program directory

      • 7db84b78d72db876698cda4ea74a9c90.exe (PID: 7448)
    • Checks supported languages

      • 7db84b78d72db876698cda4ea74a9c90.exe (PID: 7448)
    • Reads the computer name

      • 7db84b78d72db876698cda4ea74a9c90.exe (PID: 7448)
    • Checks proxy server information

      • 7db84b78d72db876698cda4ea74a9c90.exe (PID: 7448)
      • slui.exe (PID: 8012)
    • Creates files or folders in the user directory

      • 7db84b78d72db876698cda4ea74a9c90.exe (PID: 7448)
    • Reads the software policy settings

      • 7db84b78d72db876698cda4ea74a9c90.exe (PID: 7448)
      • slui.exe (PID: 8012)
    • Reads the machine GUID from the registry

      • 7db84b78d72db876698cda4ea74a9c90.exe (PID: 7448)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:02:24 04:48:01+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 115200
InitializedDataSize: 25600
UninitializedDataSize: -
EntryPoint: 0x47c000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
126
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #VIDAR 7db84b78d72db876698cda4ea74a9c90.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
7448"C:\Users\admin\Desktop\7db84b78d72db876698cda4ea74a9c90.exe" C:\Users\admin\Desktop\7db84b78d72db876698cda4ea74a9c90.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\7db84b78d72db876698cda4ea74a9c90.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
8012C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
6 783
Read events
6 780
Write events
3
Delete events
0

Modification events

(PID) Process:(7448) 7db84b78d72db876698cda4ea74a9c90.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7448) 7db84b78d72db876698cda4ea74a9c90.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7448) 7db84b78d72db876698cda4ea74a9c90.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
25
DNS requests
6
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
167.235.59.196:443
https://x.p.formaxprime.co.uk/
unknown
6656
RUXIMICS.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
2104
svchost.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
149.154.167.99:443
https://t.me/g_etcontent
unknown
html
12.1 Kb
whitelisted
POST
200
167.235.59.196:443
https://x.p.formaxprime.co.uk/
unknown
text
2 b
malicious
POST
200
167.235.59.196:443
https://x.p.formaxprime.co.uk/
unknown
malicious
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6656
RUXIMICS.exe
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
4
System
192.168.100.255:137
whitelisted
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7448
7db84b78d72db876698cda4ea74a9c90.exe
149.154.167.99:443
t.me
Telegram Messenger Inc
GB
whitelisted
6656
RUXIMICS.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
2104
svchost.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
7448
7db84b78d72db876698cda4ea74a9c90.exe
167.235.59.196:443
x.p.formaxprime.co.uk
Hetzner Online GmbH
DE
unknown
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
whitelisted
t.me
  • 149.154.167.99
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
x.p.formaxprime.co.uk
  • 167.235.59.196
malicious
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
7448
7db84b78d72db876698cda4ea74a9c90.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
A Network Trojan was detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1
No debug info