Overview

overview

10

Static

static

464464b0f2...34.exe

windows7_x64

10

464464b0f2...34.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    137s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    09-11-2020 19:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    464464b0f26f533bb0c6f48a744bf334.exe

  • Size

    685KB

  • MD5

    464464b0f26f533bb0c6f48a744bf334

  • SHA1

    91f80b92ade33c48e74c587a2e9c51d164d81dd8

  • SHA256

    fcac1c6c86cda94817da16feb772744ab591e3d1192955b32b074034ea122bf1

  • SHA512

    fa96a422461391481fdf41a30175f3e2adc5add8fad5b9fc1bb4ac60250998342ad8be5b932dfb58d36c5d0a9e5c1c7537d679908b47398026e99661ede9442e

Score
10/10
vidardiscoverystealer

Malware Config

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies Control Panel 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 273 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\464464b0f26f533bb0c6f48a744bf334.exe
    "C:\Users\Admin\AppData\Local\Temp\464464b0f26f533bb0c6f48a744bf334.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
      "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2920
    • C:\Windows\SysWOW64\regedit.exe
      "C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg
      2⤵
      • Runs .reg file with regedit
      PID:1016
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3108
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:1128
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2348
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:3864
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:4496
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:4616
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:4704

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
    MD5

    1f6e2424d4cef4fb05c640df6b1bef80

    SHA1

    9f6682868a01f4c219fdc277df8f44d9f3df30fc

    SHA256

    c86e72d4f676982b9d3b79343d29f604a3402c42bb6f38a672f5162191627990

    SHA512

    c7511146d3603b395b65cc66a239142ca1c16a2498d6e901c311328bc2d8f29ec9b2151b239fce13ab90148d24cb45f0794cd13592827f5cc4209a918fe66769

    Download Submit
  • C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
    MD5

    1f6e2424d4cef4fb05c640df6b1bef80

    SHA1

    9f6682868a01f4c219fdc277df8f44d9f3df30fc

    SHA256

    c86e72d4f676982b9d3b79343d29f604a3402c42bb6f38a672f5162191627990

    SHA512

    c7511146d3603b395b65cc66a239142ca1c16a2498d6e901c311328bc2d8f29ec9b2151b239fce13ab90148d24cb45f0794cd13592827f5cc4209a918fe66769

    Download Submit
  • memory/1016-3-0x0000000000000000-mapping.dmp
    Download
  • memory/2920-0-0x0000000000000000-mapping.dmp
    Download
  • memory/2920-4-0x0000000000B51000-0x0000000000B52000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2920-5-0x0000000000C40000-0x0000000000C41000-memory.dmp
    Filesize

    4KB

    Download