vidar | bc442d325a19719ed3271820fdec5e641d1ae4f2af2c9adf75b68f779d4cc1cb

Analysis

max time kernel
69s
max time network
130s
platform
windows10_x64
resource
win10
submitted
31-07-2020 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97371d452110396d930cb53a8149fab7.exe
Size

595KB
MD5

97371d452110396d930cb53a8149fab7
SHA1

59beae27aec8495ed221d5b52c8d4883aa7336df
SHA256

bc442d325a19719ed3271820fdec5e641d1ae4f2af2c9adf75b68f779d4cc1cb
SHA512

1ff2bdcf66f7c73c7bcb882f3c66b0edf09ce0954420857b1b020fd68fbcb6062ba080fbe2d03731a0a4011807eba7d78abeb136722f4bb5b02486dc02805118

Score

10^/10

discovery spyware stealer vidar

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 4112 created 1812 4112 WerFault.exe MicrosoftEdge.exe
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Executes dropped EXE 4 IoCs

Processes:

wotsuper.exewotsuper1.exedff58fc7..exedff58fc7..exe

pid process

3976 wotsuper.exe
4004 wotsuper1.exe
4752 dff58fc7..exe
5100 dff58fc7..exe

description	pid	process	target process
PID 4112 created 1812	4112	WerFault.exe	MicrosoftEdge.exe

pid	process
3976	wotsuper.exe
4004	wotsuper1.exe
4752	dff58fc7..exe
5100	dff58fc7..exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

97371d452110396d930cb53a8149fab7.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\International\Geo\Nation	97371d452110396d930cb53a8149fab7.exe

Loads dropped DLL 3 IoCs

Processes:

wotsuper.exedff58fc7..exe

pid process

3976 wotsuper.exe
3976 wotsuper.exe
5100 dff58fc7..exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
JavaScript code in executable 1 IoCs

Processes:

resource yara_rule

\ProgramData\nss3.dll js
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 ip-api.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4112 1812 WerFault.exe MicrosoftEdge.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

dff58fc7..exe

description pid process target process

PID 4752 set thread context of 5100 4752 dff58fc7..exe dff58fc7..exe

pid	process
3976	wotsuper.exe
3976	wotsuper.exe
5100	dff58fc7..exe

resource	yara_rule
\ProgramData\nss3.dll	js

flow	ioc
16	ip-api.com

pid	pid_target	process	target process
4112	1812	WerFault.exe	MicrosoftEdge.exe

description	pid	process	target process
PID 4752 set thread context of 5100	4752	dff58fc7..exe	dff58fc7..exe

Drops file in Program Files directory 4 IoCs

Processes:

97371d452110396d930cb53a8149fab7.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe	97371d452110396d930cb53a8149fab7.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe	97371d452110396d930cb53a8149fab7.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.exe	97371d452110396d930cb53a8149fab7.exe
File created	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.ini	97371d452110396d930cb53a8149fab7.exe

Drops file in Windows directory 2 IoCs

Processes:

97371d452110396d930cb53a8149fab7.exeMicrosoftEdge.exe

description	ioc	process
File opened for modification	C:\Windows\wotsuper.reg	97371d452110396d930cb53a8149fab7.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wotsuper.exeWerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wotsuper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wotsuper.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4988 taskkill.exe
Modifies Control Panel 1 IoCs
evasion

Processes:

MicrosoftEdge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Colors MicrosoftEdge.exe

pid	process
4988	taskkill.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Colors	MicrosoftEdge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies registry class 113 IoCs

Processes:

MicrosoftEdge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000d23f7d3a4ca71855e41c34832fb8c8a432f2458b20204dc961022b81a71767f0dba321d8379bd5523ce17e96368b8193d118f157fdcc5c5a5b9d95a42a67cad696544ead1fa86dc5625adcc84d65b27632d2c5389b23d066c318	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{ACE2D7AA-6AF9-4C50-83BD-BAD0EEE458AD} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 8a978de4d243d601	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000002a882340442e6548ec671092e7366edd0a5626539854b937f9443e91dfafa5a533bb7c212fb5ffee3273ce3e5f656338d89d0b494ad09bc4f332	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 8a978de4d243d601	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

3800 regedit.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4908 PING.EXE

pid	process
3800	regedit.exe

pid	process
4908	PING.EXE

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

WerFault.exewotsuper.exewotsuper1.exe

pid	process
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
4112	WerFault.exe
3976	wotsuper.exe
3976	wotsuper.exe
3976	wotsuper.exe
3976	wotsuper.exe
3976	wotsuper.exe
3976	wotsuper.exe
4004	wotsuper1.exe
4004	wotsuper1.exe
3976	wotsuper.exe
3976	wotsuper.exe
4004	wotsuper1.exe
4004	wotsuper1.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

MicrosoftEdge.exeWerFault.exewotsuper1.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1812	MicrosoftEdge.exe
Token: SeDebugPrivilege	1812	MicrosoftEdge.exe
Token: SeDebugPrivilege	1812	MicrosoftEdge.exe
Token: SeDebugPrivilege	1812	MicrosoftEdge.exe
Token: SeDebugPrivilege	4112	WerFault.exe
Token: SeDebugPrivilege	4004	wotsuper1.exe
Token: SeDebugPrivilege	4988	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MicrosoftEdge.exe

pid process

1812 MicrosoftEdge.exe

pid	process
1812	MicrosoftEdge.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

97371d452110396d930cb53a8149fab7.exewotsuper1.execmd.exewotsuper.execmd.exedff58fc7..exe

description	pid	process	target process
PID 3100 wrote to memory of 3976	3100	97371d452110396d930cb53a8149fab7.exe	wotsuper.exe
PID 3100 wrote to memory of 3976	3100	97371d452110396d930cb53a8149fab7.exe	wotsuper.exe
PID 3100 wrote to memory of 3976	3100	97371d452110396d930cb53a8149fab7.exe	wotsuper.exe
PID 3100 wrote to memory of 4004	3100	97371d452110396d930cb53a8149fab7.exe	wotsuper1.exe
PID 3100 wrote to memory of 4004	3100	97371d452110396d930cb53a8149fab7.exe	wotsuper1.exe
PID 3100 wrote to memory of 4004	3100	97371d452110396d930cb53a8149fab7.exe	wotsuper1.exe
PID 3100 wrote to memory of 3800	3100	97371d452110396d930cb53a8149fab7.exe	regedit.exe
PID 3100 wrote to memory of 3800	3100	97371d452110396d930cb53a8149fab7.exe	regedit.exe
PID 3100 wrote to memory of 3800	3100	97371d452110396d930cb53a8149fab7.exe	regedit.exe
PID 4004 wrote to memory of 4752	4004	wotsuper1.exe	dff58fc7..exe
PID 4004 wrote to memory of 4752	4004	wotsuper1.exe	dff58fc7..exe
PID 4004 wrote to memory of 4752	4004	wotsuper1.exe	dff58fc7..exe
PID 4004 wrote to memory of 4864	4004	wotsuper1.exe	cmd.exe
PID 4004 wrote to memory of 4864	4004	wotsuper1.exe	cmd.exe
PID 4004 wrote to memory of 4864	4004	wotsuper1.exe	cmd.exe
PID 4864 wrote to memory of 4908	4864	cmd.exe	PING.EXE
PID 4864 wrote to memory of 4908	4864	cmd.exe	PING.EXE
PID 4864 wrote to memory of 4908	4864	cmd.exe	PING.EXE
PID 3976 wrote to memory of 4944	3976	wotsuper.exe	cmd.exe
PID 3976 wrote to memory of 4944	3976	wotsuper.exe	cmd.exe
PID 3976 wrote to memory of 4944	3976	wotsuper.exe	cmd.exe
PID 4944 wrote to memory of 4988	4944	cmd.exe	taskkill.exe
PID 4944 wrote to memory of 4988	4944	cmd.exe	taskkill.exe
PID 4944 wrote to memory of 4988	4944	cmd.exe	taskkill.exe
PID 4752 wrote to memory of 5100	4752	dff58fc7..exe	dff58fc7..exe
PID 4752 wrote to memory of 5100	4752	dff58fc7..exe	dff58fc7..exe
PID 4752 wrote to memory of 5100	4752	dff58fc7..exe	dff58fc7..exe
PID 4752 wrote to memory of 5100	4752	dff58fc7..exe	dff58fc7..exe
PID 4752 wrote to memory of 5100	4752	dff58fc7..exe	dff58fc7..exe
PID 4752 wrote to memory of 5100	4752	dff58fc7..exe	dff58fc7..exe

C:\Users\Admin\AppData\Local\Temp\97371d452110396d930cb53a8149fab7.exe
"C:\Users\Admin\AppData\Local\Temp\97371d452110396d930cb53a8149fab7.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3100

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3976

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im wotsuper.exe /f & erase C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:4944

C:\Windows\SysWOW64\taskkill.exe
taskkill /im wotsuper.exe /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004

C:\Users\Admin\AppData\Local\Temp\dff58fc7..exe
"C:\Users\Admin\AppData\Local\Temp\dff58fc7..exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4752

C:\Users\Admin\AppData\Local\Temp\dff58fc7..exe
"C:\Users\Admin\AppData\Local\Temp\dff58fc7..exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5100

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:4864

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
4⤵
- Runs ping.exe
PID:4908

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg
2⤵
- Runs .reg file with regedit
PID:3800

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1812

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1812 -s 3464
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3460

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
befcd9935633f7417e28f2660d676365

SHA1
c293d06c991fde8c562b898472a318b0afa067e9

SHA256
de6bbc1648a408ff79f5c7e48c25e0095251ecb0fde4ad88fd94adb6d03710b7

SHA512
03d34c622fdcc100832831d24eec3e1f8bc65ed22ab160bf032895fc18aebe0e66d403e380705207b7ed001215d7801f0d95af464f72108333e304a5837b828d

Download Submit
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
befcd9935633f7417e28f2660d676365

SHA1
c293d06c991fde8c562b898472a318b0afa067e9

SHA256
de6bbc1648a408ff79f5c7e48c25e0095251ecb0fde4ad88fd94adb6d03710b7

SHA512
03d34c622fdcc100832831d24eec3e1f8bc65ed22ab160bf032895fc18aebe0e66d403e380705207b7ed001215d7801f0d95af464f72108333e304a5837b828d

Download Submit
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
MD5
e824c09b483093d4825c5ccf76539123

SHA1
66399a2d4abdf4f29a35a350ef94946527c7b4d2

SHA256
a59e157f814cc47b7f49905796ff81659ecd3e90cf6a96ab2aa5328ea8fbf65e

SHA512
883ad2fbd85a32bb39791b4be52d798c59bfab84bd68fbb6a292afcdacd61e3d7b1e7981748821679e411a51e7dd02b736b42f2a1f7ef0a35e1758cb94e10433

Download Submit
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
MD5
e824c09b483093d4825c5ccf76539123

SHA1
66399a2d4abdf4f29a35a350ef94946527c7b4d2

SHA256
a59e157f814cc47b7f49905796ff81659ecd3e90cf6a96ab2aa5328ea8fbf65e

SHA512
883ad2fbd85a32bb39791b4be52d798c59bfab84bd68fbb6a292afcdacd61e3d7b1e7981748821679e411a51e7dd02b736b42f2a1f7ef0a35e1758cb94e10433

Download Submit
C:\Users\Admin\AppData\Local\Temp\dff58fc7..exe
MD5
d5de3de111df4e947fbd5a8b75ed895f

SHA1
87e886381efea64e8f4e749fd98652cf7b537acf

SHA256
565c510fe3aeffd717439611986e9b0c15d943721019f90eaae35d4cd514a415

SHA512
1ecbcfe2deec35160433fe3a22f3b5fc43118f91cf3805ed3231df4bf13f59e9792d9a3248827022ca7f4b67535de787b55be68cc9a578af59ae9e29672ae468

Download Submit
C:\Users\Admin\AppData\Local\Temp\dff58fc7..exe
MD5
d5de3de111df4e947fbd5a8b75ed895f

SHA1
87e886381efea64e8f4e749fd98652cf7b537acf

SHA256
565c510fe3aeffd717439611986e9b0c15d943721019f90eaae35d4cd514a415

SHA512
1ecbcfe2deec35160433fe3a22f3b5fc43118f91cf3805ed3231df4bf13f59e9792d9a3248827022ca7f4b67535de787b55be68cc9a578af59ae9e29672ae468

Download Submit
C:\Users\Admin\AppData\Local\Temp\dff58fc7..exe
MD5
d5de3de111df4e947fbd5a8b75ed895f

SHA1
87e886381efea64e8f4e749fd98652cf7b537acf

SHA256
565c510fe3aeffd717439611986e9b0c15d943721019f90eaae35d4cd514a415

SHA512
1ecbcfe2deec35160433fe3a22f3b5fc43118f91cf3805ed3231df4bf13f59e9792d9a3248827022ca7f4b67535de787b55be68cc9a578af59ae9e29672ae468

Download Submit
\ProgramData\mozglue.dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll
MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
\Users\Admin\AppData\Local\Temp\D47F.tmp
MD5
50741b3f2d7debf5d2bed63d88404029

SHA1
56210388a627b926162b36967045be06ffb1aad3

SHA256
f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

SHA512
fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

Download Submit
memory/3800-6-0x0000000000000000-mapping.dmp

Download
memory/3976-0-0x0000000000000000-mapping.dmp

Download
memory/4004-7-0x0000000000600000-0x0000000000617000-memory.dmp

Filesize
92KB

Download
memory/4004-13-0x00000000022B0000-0x00000000022CE000-memory.dmp

Filesize
120KB

Download
memory/4004-2-0x0000000000000000-mapping.dmp

Download
memory/4112-16-0x0000021A4C490000-0x0000021A4C491000-memory.dmp

Filesize
4KB

Download
memory/4112-12-0x0000021A4C330000-0x0000021A4C331000-memory.dmp

Filesize
4KB

Download
memory/4112-10-0x0000021A4B440000-0x0000021A4B441000-memory.dmp

Filesize
4KB

Download
memory/4112-9-0x0000021A4B440000-0x0000021A4B441000-memory.dmp

Filesize
4KB

Download
memory/4752-108-0x0000000003651000-0x0000000003652000-memory.dmp

Filesize
4KB

Download
memory/4752-109-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/4752-84-0x0000000000000000-mapping.dmp

Download
memory/4864-104-0x0000000000000000-mapping.dmp

Download
memory/4908-105-0x0000000000000000-mapping.dmp

Download
memory/4944-106-0x0000000000000000-mapping.dmp

Download
memory/4988-107-0x0000000000000000-mapping.dmp

Download
memory/5100-110-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5100-111-0x0000000000402C70-mapping.dmp

Download