File name:	NwIns.exe
Full analysis:	https://app.any.run/tasks/f19ea3a9-9829-4cc5-bf13-3eb4cbce5147
Verdict:	Malicious activity
Threats:	A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Stealc is a stealer malware that targets victims’ sensitive data, which it exfiltrates from browsers, messaging apps, and other software. The malware is equipped with advanced features, including fingerprinting, control panel, evasion mechanisms, string obfuscation, etc. Stealc establishes persistence and communicates with its C2 server through HTTP POST requests. Stealc ist eine Stealer-Malware, die es auf die sensiblen Daten der Opfer abgesehen hat, die sie aus Browsern, Messaging-Apps und anderer Software exfiltriert. Die Malware ist mit fortschrittlichen Funktionen ausgestattet, darunter Fingerprinting, Bedienfeld, Umgehungsmechanismen, String-Verschleierung usw. Stealc stellt eine Persistenz her und kommuniziert mit seinem C2-Server über HTTP-POST-Anfragen. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Vidar is a dangerous malware that steals information and cryptocurrency from infected users. It derives its name from the ancient Scandinavian god of Vengeance. This stealer has been terrorizing the internet since 2018. Malware Trends Tracker >>>
Analysis date:	November 01, 2024, 15:16:30
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	autoit-loader telegram stealer stealc vidar loader
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:	EBE0D35F9FCEF8DE203E66B161AA5F9A
SHA1:	3788CE60F120E76498AB6713AA26D112F61E54F8
SHA256:	A4E0FD3483E26B4C0DFDA5B2C1CB89571E06A8162E88B8A47A810A4B38934B1F
SSDEEP:	98304:/XDHOiDKDt4WUaV8MCz2oIKkqsUvaRBAKcTY+zkPgl9B8oXQ4TA1JO4XX5qPxMk0:fa+1E

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2012:02:24 19:19:54+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	28160
InitializedDataSize:	582144
UninitializedDataSize:	16896
EntryPoint:	0x3883
OSVersion:	5
ImageVersion:	6
SubsystemVersion:	5
Subsystem:	Windows GUI
FileVersionNumber:	0.38.6.31535
ProductVersionNumber:	0.38.6.31535
FileFlagsMask:	0x0000
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Unicode
LegalTrademarks:	VirtuChat is a trademark of CyberSphere Dynamics
ProductName:	VirtuChat


(PID) Process:	(7128) Licensing.pif	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(7128) Licensing.pif	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(7128) Licensing.pif	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(6464) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:	write	Name:	failed_count
Value: 0
(PID) Process:	(6464) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:	write	Name:	state
Value: 2
(PID) Process:	(6464) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:	write	Name:	state
Value: 1
(PID) Process:	(6464) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:	write	Name:	user_experience_metrics.stability.exited_cleanly
Value: 0
(PID) Process:	(6464) chrome.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:	write	Name:	usagestats
Value: 0
(PID) Process:	(696) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	failed_count
Value: 0
(PID) Process:	(696) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	state
Value: 2

PID	Process	Filename		Type
6696	NwIns.exe	C:\Users\admin\AppData\Local\Temp\Bloomberg		binary
		MD5:D32B0431B2E65F997CA87207D1904893	SHA256:E22D1257D9A19A6597EA94296A852085D0DA01065BCE2C74FDD770F2103161FB
6696	NwIns.exe	C:\Users\admin\AppData\Local\Temp\Jewellery		binary
		MD5:8AF862043B88AB64B0A0A0DAB0EE33F7	SHA256:7A3F09215A0188D7637DCE287A9149459EF15306FC43EC50333C5A995ACFBA11
6696	NwIns.exe	C:\Users\admin\AppData\Local\Temp\Victory		binary
		MD5:7B988BE6DA7644D4D9E0E86933E54DA2	SHA256:D513452C3ACDA65A2392928F739D8E31F600B8A6173726277E8255C1AAC61498
6696	NwIns.exe	C:\Users\admin\AppData\Local\Temp\Iii		binary
		MD5:4C0D024A42CC231478B67FE37FD43462	SHA256:85841D6043A23D3D184B89FA1919AF49624261C67E2844CB91B9D1EFB50AF8C9
6696	NwIns.exe	C:\Users\admin\AppData\Local\Temp\Youth		binary
		MD5:A396D94491BE6CE59FEAA97EBFB1F612	SHA256:F9713C5DACB56F321966719CE247C422A486A520A3FABE2528147BB5C49D9CF7
6696	NwIns.exe	C:\Users\admin\AppData\Local\Temp\Lung		binary
		MD5:E2AC62717D8316156140DE7C9FEC5684	SHA256:A7AA95DF3C7BAB0D3426BAAA1A221764335765A780B62C33633FE026A9A78F42
6696	NwIns.exe	C:\Users\admin\AppData\Local\Temp\Ignore		binary
		MD5:77FD94CF43AC2BD457FDE50645B9DFFC	SHA256:191442382E0569404FE150B7C7EDBD159FA32B532BBF0802E182BA4F28FCA773
6696	NwIns.exe	C:\Users\admin\AppData\Local\Temp\Dirt		binary
		MD5:9E7954674DA82C0CF7532BACFBD8E87E	SHA256:FBB7C957094C97D119A9562535F1F21E39DE6897A14F257548B88A589397D572
6696	NwIns.exe	C:\Users\admin\AppData\Local\Temp\Berry		binary
		MD5:92284068F21C1B0F6213F283FA4CDFBF	SHA256:ED04D45F1D62155FAC17E7C0906BCC9DE7B118557B3A1EC16DEC6BB851BDCB7F
6696	NwIns.exe	C:\Users\admin\AppData\Local\Temp\Discretion		binary
		MD5:8EC9927E21BE4A805CCD718C469543A8	SHA256:BD49F72818822441C869D3E9F7A9E80A2BD8D9E70B8BC33322DE43E01611E905

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5488	MoUsoCoreWorker.exe	GET	200	2.16.241.12:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
6944	svchost.exe	GET	200	2.16.241.12:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
864	RUXIMICS.exe	GET	200	2.16.241.12:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
6944	svchost.exe	GET	200	23.32.185.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
864	RUXIMICS.exe	GET	200	23.32.185.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5488	MoUsoCoreWorker.exe	GET	200	23.32.185.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	GET	200	142.250.186.164:443	https://tavukdun.website/	unknown	—	—	—
—	—	GET	—	142.250.186.164:443	https://www.google.com/async/ddljson?async=ntp:2	unknown	—	—	—
—	—	OPTIONS	200	142.250.185.74:443	https://ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData	unknown	—	—	—
—	—	GET	200	142.250.186.110:443	https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	unknown	—	—	—

PID	Process	IP	Domain	ASN	CN	Reputation
6944	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
864	RUXIMICS.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
5488	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	2.23.209.140:443	www.bing.com	Akamai International B.V.	GB	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
6944	svchost.exe	2.16.241.12:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5488	MoUsoCoreWorker.exe	2.16.241.12:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
864	RUXIMICS.exe	2.16.241.12:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
6944	svchost.exe	23.32.185.131:80	www.microsoft.com	AKAMAI-AS	BR	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208 4.231.128.59	whitelisted
google.com	142.250.185.206	whitelisted
crl.microsoft.com	2.16.241.12 2.16.241.19	whitelisted
www.microsoft.com	23.32.185.131	whitelisted
pwysHRpmAnwXHpqGrSQwZ.pwysHRpmAnwXHpqGrSQwZ	—	unknown
self.events.data.microsoft.com	51.105.71.137	whitelisted
t.me	149.154.167.99	whitelisted
tavukdun.website	188.114.97.3 188.114.96.3	malicious
clientservices.googleapis.com	216.58.212.163	whitelisted
accounts.google.com	66.102.1.84	whitelisted

PID	Process	Class	Message
7128	Licensing.pif	Misc activity	ET INFO Observed Telegram Domain (t .me in TLS SNI)
—	—	A Network Trojan was detected	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST
—	—	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1
—	—	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
—	—	A suspicious filename was detected	ET HUNTING HTTP GET Request for freebl3.dll - Possible Infostealer Activity
—	—	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
—	—	A suspicious filename was detected	ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity
—	—	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
—	—	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
—	—	A suspicious filename was detected	ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity

General Info

NwIns.exe

EBE0D35F9FCEF8DE203E66B161AA5F9A

3788CE60F120E76498AB6713AA26D112F61E54F8

A4E0FD3483E26B4C0DFDA5B2C1CB89571E06A8162E88B8A47A810A4B38934B1F

98304:/XDHOiDKDt4WUaV8MCz2oIKkqsUvaRBAKcTY+zkPgl9B8oXQ4TA1JO4XX5qPxMk0:fa+1E

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

AutoIt loader has been detected (YARA)

SUSPICIOUS

Reads security settings of Internet Explorer

Executing commands from a ".bat" file

Starts CMD.EXE for commands execution

Get information on the list of running processes

Using 'findstr.exe' to search for text patterns in files and output

Process drops legitimate windows executable

The process drops C-runtime libraries

Executable content was dropped or overwritten

Starts application with an unusual extension

Application launched itself

The executable file from the user directory is run by the CMD process

Process communicates with Telegram (possibly using it as an attacker's C2 server)

The process drops Mozilla's DLL files

INFO

Reads the computer name

Checks supported languages

Create files in a temporary directory

Process checks computer location settings

Creates a new folder

Application launched itself

The process uses the downloaded file

Attempting to use instant messaging service

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings