vidar | 1912d659af4fedbc9e143eff5e666ce460a710fd84c83f7a4c4d8170356e578a

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7
submitted
31-07-2020 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b0f78e83f4027c6b6bd15af68b68af2.exe
Size

595KB
MD5

7b0f78e83f4027c6b6bd15af68b68af2
SHA1

cf8fdfb81265fa4ec264f787dedcc2d52c782a36
SHA256

1912d659af4fedbc9e143eff5e666ce460a710fd84c83f7a4c4d8170356e578a
SHA512

37faf89c2735d629c682048fca73b6200c9b313a26307b426f4d60028c4f1d658417629af85ef1633d560fcba0851ad6a5a16615fc7a65945343949e1610de53

Score

10^/10

stealer vidar spyware discovery

Malware Config

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Executes dropped EXE 4 IoCs

Processes:

wotsuper.exewotsuper1.exe1e52b52e..exe1e52b52e..exe

pid process

1056 wotsuper.exe
1536 wotsuper1.exe
2024 1e52b52e..exe
1488 1e52b52e..exe

pid	process
1056	wotsuper.exe
1536	wotsuper1.exe
2024	1e52b52e..exe
1488	1e52b52e..exe

Loads dropped DLL 11 IoCs

Processes:

7b0f78e83f4027c6b6bd15af68b68af2.exewotsuper.exewotsuper1.exe1e52b52e..exe1e52b52e..exe

pid	process
1612	7b0f78e83f4027c6b6bd15af68b68af2.exe
1612	7b0f78e83f4027c6b6bd15af68b68af2.exe
1612	7b0f78e83f4027c6b6bd15af68b68af2.exe
1056	wotsuper.exe
1056	wotsuper.exe
1056	wotsuper.exe
1056	wotsuper.exe
1536	wotsuper1.exe
1536	wotsuper1.exe
2024	1e52b52e..exe
1488	1e52b52e..exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
JavaScript code in executable 1 IoCs

Processes:

resource yara_rule

\ProgramData\nss3.dll js
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

25 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

1e52b52e..exe

description pid process target process

PID 2024 set thread context of 1488 2024 1e52b52e..exe 1e52b52e..exe

resource	yara_rule
\ProgramData\nss3.dll	js

flow	ioc
25	ip-api.com

description	pid	process	target process
PID 2024 set thread context of 1488	2024	1e52b52e..exe	1e52b52e..exe

Drops file in Program Files directory 4 IoCs

Processes:

7b0f78e83f4027c6b6bd15af68b68af2.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe	7b0f78e83f4027c6b6bd15af68b68af2.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe	7b0f78e83f4027c6b6bd15af68b68af2.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.exe	7b0f78e83f4027c6b6bd15af68b68af2.exe
File created	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.ini	7b0f78e83f4027c6b6bd15af68b68af2.exe

Drops file in Windows directory 1 IoCs

Processes:

7b0f78e83f4027c6b6bd15af68b68af2.exe

description ioc process

File opened for modification C:\Windows\wotsuper.reg 7b0f78e83f4027c6b6bd15af68b68af2.exe

description	ioc	process
File opened for modification	C:\Windows\wotsuper.reg	7b0f78e83f4027c6b6bd15af68b68af2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wotsuper.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wotsuper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wotsuper.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1804 taskkill.exe

pid	process
1804	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b0829a874ca164698fa08cb019bbab8000000000200000000001066000000010000200000003123037e194aa72f796c6b8d1a2ed48be243206b84fe1540cb096bc33203ca01000000000e800000000200002000000031127f145090290d9fb90379e49cbc711a46b31a0a8e88911d3360c28858344d90000000a14b98193a08f18c8a65ef5dfe8b5282b44a01b59ac9f7ad6018e574764ba996f45f09063b157f8bf23d9ba8a98ef267ed7f2120b5ec3a123da5024abc7a13ee7468d131b2cfd4d40a14b90a341611429345841519bf444bc16afb3b34b163b396e3eefdba523cfa4196dc4d8d8f91ec9c153d3544c14df21b7d58add55dd6c6b3f0939ae83f306ab3b9d82b5dd4e1d140000000c061731937349b41426a6f037dd1b758644048552258e8e78d4a5d39f994f670679fe650c63bc733424e5a9ba1951c2c7627a1fb539eecc9c245b02b573d4965	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A0C16C1-D31D-11EA-887E-6E6106A2BC1F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b0829a874ca164698fa08cb019bbab800000000020000000000106600000001000020000000f841de144230affaef8f58486aec609caddf0d31d31eaa0fdefd5a9dd75eb528000000000e80000000020000200000003a19962062f29368fc234ee9acd8342efff4e0cf12fcff9cae3f33ffbdc299152000000080871c63a45b4cc12f31a35b3f45be556adff8623b7f1112889e2c9dece3e62640000000fa919b26f248f340eb21cc8855e5689002c2dde14107848a293a7199b36e51de4666b2e52465cfb379cafcaa5fac642e1876aff63e8984933b320e582ea715f9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "302958309"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 701982212a67d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Modifies data under HKEY_USERS 17 IoCs

Processes:

wotsuper1.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	wotsuper1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	wotsuper1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 40154f152a67d601	wotsuper1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy = "1"	wotsuper1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wotsuper1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	wotsuper1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecision = "0"	wotsuper1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\32-e2-17-db-d2-77	wotsuper1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	wotsuper1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	wotsuper1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}	wotsuper1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecisionTime = 40154f152a67d601	wotsuper1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadNetworkName = "Network"	wotsuper1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecisionReason = "1"	wotsuper1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	wotsuper1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings	wotsuper1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	wotsuper1.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

1708 regedit.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

572 PING.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

wotsuper1.exewotsuper.exe

pid process

1536 wotsuper1.exe
1056 wotsuper.exe
1056 wotsuper.exe
1056 wotsuper.exe
1056 wotsuper.exe
1536 wotsuper1.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

taskkill.exewotsuper1.exe

description pid process

Token: SeDebugPrivilege 1804 taskkill.exe
Token: SeDebugPrivilege 1536 wotsuper1.exe
Token: SeCreateTokenPrivilege 1536 wotsuper1.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1076 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1076 iexplore.exe
1076 iexplore.exe
1300 IEXPLORE.EXE
1300 IEXPLORE.EXE
1300 IEXPLORE.EXE
1300 IEXPLORE.EXE

pid	process
1708	regedit.exe

pid	process
572	PING.EXE

pid	process
1536	wotsuper1.exe
1056	wotsuper.exe
1056	wotsuper.exe
1056	wotsuper.exe
1056	wotsuper.exe
1536	wotsuper1.exe

description	pid	process
Token: SeDebugPrivilege	1804	taskkill.exe
Token: SeDebugPrivilege	1536	wotsuper1.exe
Token: SeCreateTokenPrivilege	1536	wotsuper1.exe

pid	process
1076	iexplore.exe

pid	process
1076	iexplore.exe
1076	iexplore.exe
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

7b0f78e83f4027c6b6bd15af68b68af2.exeiexplore.exewotsuper.execmd.exewotsuper1.execmd.exe1e52b52e..exe

description	pid	process	target process
PID 1612 wrote to memory of 1076	1612	7b0f78e83f4027c6b6bd15af68b68af2.exe	iexplore.exe
PID 1612 wrote to memory of 1076	1612	7b0f78e83f4027c6b6bd15af68b68af2.exe	iexplore.exe
PID 1612 wrote to memory of 1076	1612	7b0f78e83f4027c6b6bd15af68b68af2.exe	iexplore.exe
PID 1612 wrote to memory of 1076	1612	7b0f78e83f4027c6b6bd15af68b68af2.exe	iexplore.exe
PID 1612 wrote to memory of 1056	1612	7b0f78e83f4027c6b6bd15af68b68af2.exe	wotsuper.exe
PID 1612 wrote to memory of 1056	1612	7b0f78e83f4027c6b6bd15af68b68af2.exe	wotsuper.exe
PID 1612 wrote to memory of 1056	1612	7b0f78e83f4027c6b6bd15af68b68af2.exe	wotsuper.exe
PID 1612 wrote to memory of 1056	1612	7b0f78e83f4027c6b6bd15af68b68af2.exe	wotsuper.exe
PID 1612 wrote to memory of 1536	1612	7b0f78e83f4027c6b6bd15af68b68af2.exe	wotsuper1.exe
PID 1612 wrote to memory of 1536	1612	7b0f78e83f4027c6b6bd15af68b68af2.exe	wotsuper1.exe
PID 1612 wrote to memory of 1536	1612	7b0f78e83f4027c6b6bd15af68b68af2.exe	wotsuper1.exe
PID 1612 wrote to memory of 1536	1612	7b0f78e83f4027c6b6bd15af68b68af2.exe	wotsuper1.exe
PID 1612 wrote to memory of 1708	1612	7b0f78e83f4027c6b6bd15af68b68af2.exe	regedit.exe
PID 1612 wrote to memory of 1708	1612	7b0f78e83f4027c6b6bd15af68b68af2.exe	regedit.exe
PID 1612 wrote to memory of 1708	1612	7b0f78e83f4027c6b6bd15af68b68af2.exe	regedit.exe
PID 1612 wrote to memory of 1708	1612	7b0f78e83f4027c6b6bd15af68b68af2.exe	regedit.exe
PID 1076 wrote to memory of 1300	1076	iexplore.exe	IEXPLORE.EXE
PID 1076 wrote to memory of 1300	1076	iexplore.exe	IEXPLORE.EXE
PID 1076 wrote to memory of 1300	1076	iexplore.exe	IEXPLORE.EXE
PID 1076 wrote to memory of 1300	1076	iexplore.exe	IEXPLORE.EXE
PID 1056 wrote to memory of 1508	1056	wotsuper.exe	cmd.exe
PID 1056 wrote to memory of 1508	1056	wotsuper.exe	cmd.exe
PID 1056 wrote to memory of 1508	1056	wotsuper.exe	cmd.exe
PID 1056 wrote to memory of 1508	1056	wotsuper.exe	cmd.exe
PID 1508 wrote to memory of 1804	1508	cmd.exe	taskkill.exe
PID 1508 wrote to memory of 1804	1508	cmd.exe	taskkill.exe
PID 1508 wrote to memory of 1804	1508	cmd.exe	taskkill.exe
PID 1508 wrote to memory of 1804	1508	cmd.exe	taskkill.exe
PID 1536 wrote to memory of 2024	1536	wotsuper1.exe	1e52b52e..exe
PID 1536 wrote to memory of 2024	1536	wotsuper1.exe	1e52b52e..exe
PID 1536 wrote to memory of 2024	1536	wotsuper1.exe	1e52b52e..exe
PID 1536 wrote to memory of 2024	1536	wotsuper1.exe	1e52b52e..exe
PID 1536 wrote to memory of 580	1536	wotsuper1.exe	cmd.exe
PID 1536 wrote to memory of 580	1536	wotsuper1.exe	cmd.exe
PID 1536 wrote to memory of 580	1536	wotsuper1.exe	cmd.exe
PID 1536 wrote to memory of 580	1536	wotsuper1.exe	cmd.exe
PID 580 wrote to memory of 572	580	cmd.exe	PING.EXE
PID 580 wrote to memory of 572	580	cmd.exe	PING.EXE
PID 580 wrote to memory of 572	580	cmd.exe	PING.EXE
PID 580 wrote to memory of 572	580	cmd.exe	PING.EXE
PID 2024 wrote to memory of 1488	2024	1e52b52e..exe	1e52b52e..exe
PID 2024 wrote to memory of 1488	2024	1e52b52e..exe	1e52b52e..exe
PID 2024 wrote to memory of 1488	2024	1e52b52e..exe	1e52b52e..exe
PID 2024 wrote to memory of 1488	2024	1e52b52e..exe	1e52b52e..exe
PID 2024 wrote to memory of 1488	2024	1e52b52e..exe	1e52b52e..exe
PID 2024 wrote to memory of 1488	2024	1e52b52e..exe	1e52b52e..exe
PID 2024 wrote to memory of 1488	2024	1e52b52e..exe	1e52b52e..exe

C:\Users\Admin\AppData\Local\Temp\7b0f78e83f4027c6b6bd15af68b68af2.exe
"C:\Users\Admin\AppData\Local\Temp\7b0f78e83f4027c6b6bd15af68b68af2.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1612

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1vncg7.html
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1300

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im wotsuper.exe /f & erase C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SysWOW64\taskkill.exe
taskkill /im wotsuper.exe /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1804

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1536

C:\Users\Admin\AppData\Local\Temp\1e52b52e..exe
"C:\Users\Admin\AppData\Local\Temp\1e52b52e..exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2024

C:\Users\Admin\AppData\Local\Temp\1e52b52e..exe
"C:\Users\Admin\AppData\Local\Temp\1e52b52e..exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:580

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
4⤵
- Runs ping.exe
PID:572

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg
2⤵
- Runs .reg file with regedit
PID:1708

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
befcd9935633f7417e28f2660d676365

SHA1
c293d06c991fde8c562b898472a318b0afa067e9

SHA256
de6bbc1648a408ff79f5c7e48c25e0095251ecb0fde4ad88fd94adb6d03710b7

SHA512
03d34c622fdcc100832831d24eec3e1f8bc65ed22ab160bf032895fc18aebe0e66d403e380705207b7ed001215d7801f0d95af464f72108333e304a5837b828d

Download Submit
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
MD5
e824c09b483093d4825c5ccf76539123

SHA1
66399a2d4abdf4f29a35a350ef94946527c7b4d2

SHA256
a59e157f814cc47b7f49905796ff81659ecd3e90cf6a96ab2aa5328ea8fbf65e

SHA512
883ad2fbd85a32bb39791b4be52d798c59bfab84bd68fbb6a292afcdacd61e3d7b1e7981748821679e411a51e7dd02b736b42f2a1f7ef0a35e1758cb94e10433

Download Submit
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
MD5
e824c09b483093d4825c5ccf76539123

SHA1
66399a2d4abdf4f29a35a350ef94946527c7b4d2

SHA256
a59e157f814cc47b7f49905796ff81659ecd3e90cf6a96ab2aa5328ea8fbf65e

SHA512
883ad2fbd85a32bb39791b4be52d798c59bfab84bd68fbb6a292afcdacd61e3d7b1e7981748821679e411a51e7dd02b736b42f2a1f7ef0a35e1758cb94e10433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
d84ae36716e8af0f0dc13e82e7a32ad5

SHA1
8fa333561a08606ff23793e8308d42b9a3d4845d

SHA256
aa027e256ed6de411c6f8a7ebdedd1a8a8ebd178389036b9e1d4b9e00b555ead

SHA512
f58ea3a8463c666ea9999de56ad41e83c29f8a6c2537760d61c675869f4b30cbee7f25acc7e5917e028fca88eb6ad5ca41265f31c83d5b0f81c2b50789e32779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\j8hu3ld\imagestore.dat
MD5
7df80a6bd38d1f0e7a7f040a10baea53

SHA1
60bdd49b3367aa5e7ddd7139b9f307d74329d0e2

SHA256
a2ac551b444de677ae8aab9814b26f337ec3dad363743b29b7ce96393af8ba5d

SHA512
c2afb1fdf9929c4ce0222f894f9f0de92fcf0f780fdc6a3ba15b271c29cfd1cacb49a2d3a69b0abe79d2300e78be52f0ffe26d2c1fe7c2456a014fbbb5c8decf

Download Submit
C:\Users\Admin\AppData\Local\Temp\1e52b52e..exe
MD5
d9a97096753da9101e89efe264834629

SHA1
bef5989964ecc57613554049b76086d99d4207f0

SHA256
2afb9e882933b951a803e82694e39249e51e0ec987212edc46f261240dad76b6

SHA512
4d29505235883ec980acdd62a5de049f6ae1209102c0658a70a06c0ffa7da59b312f619c9db3739da412a515b04813a09b0737d7bf64df1c8483083b01b413e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1e52b52e..exe
MD5
d9a97096753da9101e89efe264834629

SHA1
bef5989964ecc57613554049b76086d99d4207f0

SHA256
2afb9e882933b951a803e82694e39249e51e0ec987212edc46f261240dad76b6

SHA512
4d29505235883ec980acdd62a5de049f6ae1209102c0658a70a06c0ffa7da59b312f619c9db3739da412a515b04813a09b0737d7bf64df1c8483083b01b413e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1e52b52e..exe
MD5
d9a97096753da9101e89efe264834629

SHA1
bef5989964ecc57613554049b76086d99d4207f0

SHA256
2afb9e882933b951a803e82694e39249e51e0ec987212edc46f261240dad76b6

SHA512
4d29505235883ec980acdd62a5de049f6ae1209102c0658a70a06c0ffa7da59b312f619c9db3739da412a515b04813a09b0737d7bf64df1c8483083b01b413e5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\YE8HXD1X.txt
MD5
85fe0592017f78947dde94e2f2b53423

SHA1
7f228005099027ad17042c25e7fec5c7a5b87c07

SHA256
3bf4706feb7523abf4b9b6b3373e52a7253e2b2f5051343020614833d065ded1

SHA512
1d63a528817835ba2dc76bf0ae2ff22935102776ecb815c2ba100d41b8662db52c0c0a000ce1d15d0138b87620aae2cdb876dc17b7401b1c5c45bd1f32b7556e

Download Submit
\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
befcd9935633f7417e28f2660d676365

SHA1
c293d06c991fde8c562b898472a318b0afa067e9

SHA256
de6bbc1648a408ff79f5c7e48c25e0095251ecb0fde4ad88fd94adb6d03710b7

SHA512
03d34c622fdcc100832831d24eec3e1f8bc65ed22ab160bf032895fc18aebe0e66d403e380705207b7ed001215d7801f0d95af464f72108333e304a5837b828d

Download Submit
\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
befcd9935633f7417e28f2660d676365

SHA1
c293d06c991fde8c562b898472a318b0afa067e9

SHA256
de6bbc1648a408ff79f5c7e48c25e0095251ecb0fde4ad88fd94adb6d03710b7

SHA512
03d34c622fdcc100832831d24eec3e1f8bc65ed22ab160bf032895fc18aebe0e66d403e380705207b7ed001215d7801f0d95af464f72108333e304a5837b828d

Download Submit
\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
MD5
e824c09b483093d4825c5ccf76539123

SHA1
66399a2d4abdf4f29a35a350ef94946527c7b4d2

SHA256
a59e157f814cc47b7f49905796ff81659ecd3e90cf6a96ab2aa5328ea8fbf65e

SHA512
883ad2fbd85a32bb39791b4be52d798c59bfab84bd68fbb6a292afcdacd61e3d7b1e7981748821679e411a51e7dd02b736b42f2a1f7ef0a35e1758cb94e10433

Download Submit
\ProgramData\mozglue.dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\msvcp140.dll
MD5
109f0f02fd37c84bfc7508d4227d7ed5

SHA1
ef7420141bb15ac334d3964082361a460bfdb975

SHA256
334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

SHA512
46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

Download Submit
\ProgramData\nss3.dll
MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
\ProgramData\vcruntime140.dll
MD5
7587bf9cb4147022cd5681b015183046

SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628

SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

Download Submit
\Users\Admin\AppData\Local\Temp\1e52b52e..exe
MD5
d9a97096753da9101e89efe264834629

SHA1
bef5989964ecc57613554049b76086d99d4207f0

SHA256
2afb9e882933b951a803e82694e39249e51e0ec987212edc46f261240dad76b6

SHA512
4d29505235883ec980acdd62a5de049f6ae1209102c0658a70a06c0ffa7da59b312f619c9db3739da412a515b04813a09b0737d7bf64df1c8483083b01b413e5

Download Submit
\Users\Admin\AppData\Local\Temp\1e52b52e..exe
MD5
d9a97096753da9101e89efe264834629

SHA1
bef5989964ecc57613554049b76086d99d4207f0

SHA256
2afb9e882933b951a803e82694e39249e51e0ec987212edc46f261240dad76b6

SHA512
4d29505235883ec980acdd62a5de049f6ae1209102c0658a70a06c0ffa7da59b312f619c9db3739da412a515b04813a09b0737d7bf64df1c8483083b01b413e5

Download Submit
\Users\Admin\AppData\Local\Temp\1e52b52e..exe
MD5
d9a97096753da9101e89efe264834629

SHA1
bef5989964ecc57613554049b76086d99d4207f0

SHA256
2afb9e882933b951a803e82694e39249e51e0ec987212edc46f261240dad76b6

SHA512
4d29505235883ec980acdd62a5de049f6ae1209102c0658a70a06c0ffa7da59b312f619c9db3739da412a515b04813a09b0737d7bf64df1c8483083b01b413e5

Download Submit
\Users\Admin\AppData\Local\Temp\D47F.tmp
MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
memory/572-26-0x0000000000000000-mapping.dmp

Download
memory/580-25-0x0000000000000000-mapping.dmp

Download
memory/1056-3-0x0000000000000000-mapping.dmp

Download
memory/1076-0-0x0000000000000000-mapping.dmp

Download
memory/1300-11-0x0000000000000000-mapping.dmp

Download
memory/1488-32-0x0000000000402C70-mapping.dmp

Download
memory/1488-31-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1508-19-0x0000000000000000-mapping.dmp

Download
memory/1536-9-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/1536-12-0x0000000001E90000-0x0000000001EAE000-memory.dmp

Filesize
120KB

Download
memory/1536-6-0x0000000000000000-mapping.dmp

Download
memory/1708-8-0x0000000000000000-mapping.dmp

Download
memory/1804-20-0x0000000000000000-mapping.dmp

Download
memory/2024-28-0x0000000004E50000-0x0000000004E61000-memory.dmp

Filesize
68KB

Download
memory/2024-27-0x0000000003476000-0x0000000003477000-memory.dmp

Filesize
4KB

Download
memory/2024-23-0x0000000000000000-mapping.dmp

Download