Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
15-10-2021 00:11
Static task
static1
General
-
Target
976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe
-
Size
742KB
-
MD5
0eac2fdc64e289d30466ff22618edb5d
-
SHA1
3481f541e73941a052782b2f74b6e0486f973c40
-
SHA256
976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863
-
SHA512
60f7d0998c011695b7753c1555246b6998fc9c8fa179a6cd563c414afc352c5a0d69afbd55c913b259df23bd00dde419f46f44f8f48db3ad43294c4ae041287b
Malware Config
Extracted
vidar
41.3
1008
https://mas.to/@oleg98
-
profile_id
1008
Signatures
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1500-116-0x0000000003300000-0x00000000033D6000-memory.dmp family_vidar behavioral1/memory/1500-117-0x0000000000400000-0x000000000172D000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exepid process 1500 976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe 1500 976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1868 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2416 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exepid process 1500 976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe 1500 976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe 1500 976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe 1500 976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe 1500 976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe 1500 976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe 1500 976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe 1500 976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2416 taskkill.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.execmd.exedescription pid process target process PID 1500 wrote to memory of 8 1500 976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe cmd.exe PID 1500 wrote to memory of 8 1500 976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe cmd.exe PID 1500 wrote to memory of 8 1500 976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe cmd.exe PID 8 wrote to memory of 2416 8 cmd.exe taskkill.exe PID 8 wrote to memory of 2416 8 cmd.exe taskkill.exe PID 8 wrote to memory of 2416 8 cmd.exe taskkill.exe PID 8 wrote to memory of 1868 8 cmd.exe timeout.exe PID 8 wrote to memory of 1868 8 cmd.exe timeout.exe PID 8 wrote to memory of 1868 8 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe"C:\Users\Admin\AppData\Local\Temp\976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe" & del C:\ProgramData\*.dll & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 976515fb47af30526e1e6b3db5d14ab28bc3a361e1a4dd14f9797c1fbedbf863.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\freebl3.dllMD5
ef2834ac4ee7d6724f255beaf527e635
SHA15be8c1e73a21b49f353c2ecfa4108e43a883cb7b
SHA256a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba
SHA512c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2
-
C:\ProgramData\mozglue.dllMD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
C:\ProgramData\msvcp140.dllMD5
109f0f02fd37c84bfc7508d4227d7ed5
SHA1ef7420141bb15ac334d3964082361a460bfdb975
SHA256334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SHA51246eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
-
C:\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
C:\ProgramData\softokn3.dllMD5
a2ee53de9167bf0d6c019303b7ca84e5
SHA12a3c737fa1157e8483815e98b666408a18c0db42
SHA25643536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083
SHA51245b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8
-
C:\ProgramData\vcruntime140.dllMD5
7587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
\ProgramData\mozglue.dllMD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
memory/8-120-0x0000000000000000-mapping.dmp
-
memory/1500-115-0x0000000001966000-0x00000000019E2000-memory.dmpFilesize
496KB
-
memory/1500-117-0x0000000000400000-0x000000000172D000-memory.dmpFilesize
19.2MB
-
memory/1500-116-0x0000000003300000-0x00000000033D6000-memory.dmpFilesize
856KB
-
memory/1868-122-0x0000000000000000-mapping.dmp
-
memory/2416-121-0x0000000000000000-mapping.dmp