Analysis
- max time kernel
68s - max time network
132s - platform
windows10_x64 - resource
win10v20210408 - submitted
24/07/2021, 11:00
Static task
static1
Behavioral task
behavioral1
Sample
0b862b9c889d4bdc6f0bac7d702d8753.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target 0b862b9c889d4bdc6f0bac7d702d8753.exe
- Size 787KB
- Sample210724-ebkab34pn6
- SHA256 4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7
- MD5 0b862b9c889d4bdc6f0bac7d702d8753
- SHA1 fdc030df123e6e6a712cbc960a2e7c63266bf040
- SHA512 4f7284a625b4909f9a0d80023c1dbfe3ed2de8a14fdf9a5bd3687d7e2fb21e265ee6cca613e4e6c8cab35f806501b155e6ed70a11530eb1cc78dbc38b22d3e8b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
vidar
Version
-
39.6
Botnet
-
517
C2
-
https://sslamlssa1.tumblr.com/
Attributes
-
profile_id
517
Signatures
- suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
- Vidar Stealer 4 IoCs
resource yara_rule behavioral2/memory/4004-131-0x0000000000400000-0x00000000004A1000-memory.dmp family_vidar behavioral2/memory/4004-132-0x000000000046B76D-mapping.dmp family_vidar behavioral2/memory/3980-134-0x00000000026D0000-0x000000000276E000-memory.dmp family_vidar behavioral2/memory/4004-135-0x0000000000400000-0x00000000004A1000-memory.dmp family_vidar - Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 3980 build2.exe 4004 build2.exe - Modifies file permissions 1 TTPs 1 IoCs
pid Process 2388 icacls.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\cb4a6469-e469-4e26-9e0d-1537b53aa7e5\\0b862b9c889d4bdc6f0bac7d702d8753.exe\" --AutoStart" 0b862b9c889d4bdc6f0bac7d702d8753.exe - Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 api.2ip.ua 10 api.2ip.ua 18 api.2ip.ua - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 652 set thread context of 972 652 0b862b9c889d4bdc6f0bac7d702d8753.exe 75 PID 2228 set thread context of 2128 2228 0b862b9c889d4bdc6f0bac7d702d8753.exe 81 PID 3980 set thread context of 4004 3980 build2.exe 84 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 3044 4004 WerFault.exe 84 -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 0b862b9c889d4bdc6f0bac7d702d8753.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 0b862b9c889d4bdc6f0bac7d702d8753.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 972 0b862b9c889d4bdc6f0bac7d702d8753.exe 972 0b862b9c889d4bdc6f0bac7d702d8753.exe 2128 0b862b9c889d4bdc6f0bac7d702d8753.exe 2128 0b862b9c889d4bdc6f0bac7d702d8753.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 3044 WerFault.exe Token: SeBackupPrivilege 3044 WerFault.exe Token: SeDebugPrivilege 3044 WerFault.exe - Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 652 wrote to memory of 972 652 0b862b9c889d4bdc6f0bac7d702d8753.exe 75 PID 652 wrote to memory of 972 652 0b862b9c889d4bdc6f0bac7d702d8753.exe 75 PID 652 wrote to memory of 972 652 0b862b9c889d4bdc6f0bac7d702d8753.exe 75 PID 652 wrote to memory of 972 652 0b862b9c889d4bdc6f0bac7d702d8753.exe 75 PID 652 wrote to memory of 972 652 0b862b9c889d4bdc6f0bac7d702d8753.exe 75 PID 652 wrote to memory of 972 652 0b862b9c889d4bdc6f0bac7d702d8753.exe 75 PID 652 wrote to memory of 972 652 0b862b9c889d4bdc6f0bac7d702d8753.exe 75 PID 652 wrote to memory of 972 652 0b862b9c889d4bdc6f0bac7d702d8753.exe 75 PID 652 wrote to memory of 972 652 0b862b9c889d4bdc6f0bac7d702d8753.exe 75 PID 652 wrote to memory of 972 652 0b862b9c889d4bdc6f0bac7d702d8753.exe 75 PID 972 wrote to memory of 2388 972 0b862b9c889d4bdc6f0bac7d702d8753.exe 78 PID 972 wrote to memory of 2388 972 0b862b9c889d4bdc6f0bac7d702d8753.exe 78 PID 972 wrote to memory of 2388 972 0b862b9c889d4bdc6f0bac7d702d8753.exe 78 PID 972 wrote to memory of 2228 972 0b862b9c889d4bdc6f0bac7d702d8753.exe 79 PID 972 wrote to memory of 2228 972 0b862b9c889d4bdc6f0bac7d702d8753.exe 79 PID 972 wrote to memory of 2228 972 0b862b9c889d4bdc6f0bac7d702d8753.exe 79 PID 2228 wrote to memory of 2128 2228 0b862b9c889d4bdc6f0bac7d702d8753.exe 81 PID 2228 wrote to memory of 2128 2228 0b862b9c889d4bdc6f0bac7d702d8753.exe 81 PID 2228 wrote to memory of 2128 2228 0b862b9c889d4bdc6f0bac7d702d8753.exe 81 PID 2228 wrote to memory of 2128 2228 0b862b9c889d4bdc6f0bac7d702d8753.exe 81 PID 2228 wrote to memory of 2128 2228 0b862b9c889d4bdc6f0bac7d702d8753.exe 81 PID 2228 wrote to memory of 2128 2228 0b862b9c889d4bdc6f0bac7d702d8753.exe 81 PID 2228 wrote to memory of 2128 2228 0b862b9c889d4bdc6f0bac7d702d8753.exe 81 PID 2228 wrote to memory of 2128 2228 0b862b9c889d4bdc6f0bac7d702d8753.exe 81 PID 2228 wrote to memory of 2128 2228 0b862b9c889d4bdc6f0bac7d702d8753.exe 81 PID 2228 wrote to memory of 2128 2228 0b862b9c889d4bdc6f0bac7d702d8753.exe 81 PID 2128 wrote to memory of 3980 2128 0b862b9c889d4bdc6f0bac7d702d8753.exe 83 PID 2128 wrote to memory of 3980 2128 0b862b9c889d4bdc6f0bac7d702d8753.exe 83 PID 2128 wrote to memory of 3980 2128 0b862b9c889d4bdc6f0bac7d702d8753.exe 83 PID 3980 wrote to memory of 4004 3980 build2.exe 84 PID 3980 wrote to memory of 4004 3980 build2.exe 84 PID 3980 wrote to memory of 4004 3980 build2.exe 84 PID 3980 wrote to memory of 4004 3980 build2.exe 84 PID 3980 wrote to memory of 4004 3980 build2.exe 84 PID 3980 wrote to memory of 4004 3980 build2.exe 84 PID 3980 wrote to memory of 4004 3980 build2.exe 84 PID 3980 wrote to memory of 4004 3980 build2.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b862b9c889d4bdc6f0bac7d702d8753.exe"C:\Users\Admin\AppData\Local\Temp\0b862b9c889d4bdc6f0bac7d702d8753.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\0b862b9c889d4bdc6f0bac7d702d8753.exe"C:\Users\Admin\AppData\Local\Temp\0b862b9c889d4bdc6f0bac7d702d8753.exe"2⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\cb4a6469-e469-4e26-9e0d-1537b53aa7e5" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:2388
-
-
C:\Users\Admin\AppData\Local\Temp\0b862b9c889d4bdc6f0bac7d702d8753.exe"C:\Users\Admin\AppData\Local\Temp\0b862b9c889d4bdc6f0bac7d702d8753.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\0b862b9c889d4bdc6f0bac7d702d8753.exe"C:\Users\Admin\AppData\Local\Temp\0b862b9c889d4bdc6f0bac7d702d8753.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\d6d4dbe2-5a0b-4e45-93de-64beaf6bd61d\build2.exe"C:\Users\Admin\AppData\Local\d6d4dbe2-5a0b-4e45-93de-64beaf6bd61d\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\d6d4dbe2-5a0b-4e45-93de-64beaf6bd61d\build2.exe"C:\Users\Admin\AppData\Local\d6d4dbe2-5a0b-4e45-93de-64beaf6bd61d\build2.exe"6⤵
- Executes dropped EXE
PID:4004 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 8807⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
-
-
-
-
-