Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    123s
  • max time network
    157s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    16/10/2021, 00:21

General

  • Target

    fb0cb1729427d65c1f277d176146e5452c8614e33cb0896a26af5fbb0ea3a886.exe

  • Size

    727KB

  • MD5

    f910255f4ace1b36d8ae4e4529da6754

  • SHA1

    650f4289e43c451095a9946c9391594e263c0fd5

  • SHA256

    fb0cb1729427d65c1f277d176146e5452c8614e33cb0896a26af5fbb0ea3a886

  • SHA512

    241a45ac29b430aa67c85591258022c5b00b6bb55247f51f7ffcb73be1276cf4bc8f4649ba668b6885cbbbfee8609fda788b63b1169c86200d633ff70451b6e5

Malware Config

Extracted

Family

vidar

Version

41.4

Botnet

1008

C2

https://mas.to/@sslam

Attributes
  • profile_id

    1008

Signatures

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Vidar Stealer 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • Loads dropped DLL 2 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry key 1 TTPs 1 IoCs
  • NTFS ADS 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb0cb1729427d65c1f277d176146e5452c8614e33cb0896a26af5fbb0ea3a886.exe
    "C:\Users\Admin\AppData\Local\Temp\fb0cb1729427d65c1f277d176146e5452c8614e33cb0896a26af5fbb0ea3a886.exe"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\ProgramData\O6DV018CD4UB8WOM.exe
      "C:\ProgramData\O6DV018CD4UB8WOM.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3896
      • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
        "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:964
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
          4⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2796
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hlhsew5i\hlhsew5i.cmdline"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1568
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE7C.tmp" "c:\Users\Admin\AppData\Local\Temp\hlhsew5i\CSCDE9952661A4146A1965C9E710AF8E9.TMP"
              6⤵
                PID:2276
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3016
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3256
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:692
            • C:\Windows\SysWOW64\reg.exe
              "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
              5⤵
                PID:1168
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
                5⤵
                • Modifies registry key
                PID:960
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
                5⤵
                  PID:1172
                • C:\Windows\SysWOW64\net.exe
                  "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1748
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                    6⤵
                      PID:3532
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3796
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c net start rdpdr
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1836
                      • C:\Windows\SysWOW64\net.exe
                        net start rdpdr
                        7⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2296
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 start rdpdr
                          8⤵
                            PID:416
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2480
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c net start TermService
                        6⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2036
                        • C:\Windows\SysWOW64\net.exe
                          net start TermService
                          7⤵
                            PID:3088
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 start TermService
                              8⤵
                                PID:392
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                          5⤵
                            PID:1516
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                            5⤵
                              PID:2092
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 2280
                        2⤵
                        • Program crash
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1940

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • memory/692-819-0x000000007F3F0000-0x000000007F3F1000-memory.dmp

                      Filesize

                      4KB

                    • memory/692-722-0x00000000072E0000-0x00000000072E1000-memory.dmp

                      Filesize

                      4KB

                    • memory/692-724-0x00000000072E2000-0x00000000072E3000-memory.dmp

                      Filesize

                      4KB

                    • memory/964-151-0x0000000005114000-0x0000000005115000-memory.dmp

                      Filesize

                      4KB

                    • memory/964-140-0x0000000000400000-0x000000000080B000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/964-143-0x0000000005110000-0x0000000005111000-memory.dmp

                      Filesize

                      4KB

                    • memory/964-142-0x0000000000400000-0x000000000080B000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/964-144-0x0000000005530000-0x000000000592F000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/964-145-0x0000000005112000-0x0000000005113000-memory.dmp

                      Filesize

                      4KB

                    • memory/964-146-0x0000000005113000-0x0000000005114000-memory.dmp

                      Filesize

                      4KB

                    • memory/964-149-0x0000000005A60000-0x0000000005A61000-memory.dmp

                      Filesize

                      4KB

                    • memory/964-136-0x0000000000400000-0x000000000080B000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/2352-117-0x0000000000400000-0x0000000001729000-memory.dmp

                      Filesize

                      19.2MB

                    • memory/2352-116-0x00000000033D0000-0x00000000034A6000-memory.dmp

                      Filesize

                      856KB

                    • memory/2796-165-0x0000000008010000-0x0000000008011000-memory.dmp

                      Filesize

                      4KB

                    • memory/2796-182-0x0000000006983000-0x0000000006984000-memory.dmp

                      Filesize

                      4KB

                    • memory/2796-171-0x0000000009620000-0x0000000009621000-memory.dmp

                      Filesize

                      4KB

                    • memory/2796-172-0x0000000008CA0000-0x0000000008CA1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2796-164-0x0000000007F40000-0x0000000007F41000-memory.dmp

                      Filesize

                      4KB

                    • memory/2796-163-0x0000000007C80000-0x0000000007C81000-memory.dmp

                      Filesize

                      4KB

                    • memory/2796-162-0x00000000078B0000-0x00000000078B1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2796-160-0x00000000077D0000-0x00000000077D1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2796-159-0x0000000006EC0000-0x0000000006EC1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2796-158-0x0000000006982000-0x0000000006983000-memory.dmp

                      Filesize

                      4KB

                    • memory/2796-157-0x0000000006980000-0x0000000006981000-memory.dmp

                      Filesize

                      4KB

                    • memory/2796-180-0x0000000008D30000-0x0000000008D31000-memory.dmp

                      Filesize

                      4KB

                    • memory/2796-156-0x0000000006FC0000-0x0000000006FC1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2796-153-0x00000000042C0000-0x00000000042C1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2796-203-0x0000000006B10000-0x0000000006B11000-memory.dmp

                      Filesize

                      4KB

                    • memory/2796-154-0x00000000042C0000-0x00000000042C1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2796-155-0x00000000067D0000-0x00000000067D1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2796-167-0x00000000042C0000-0x00000000042C1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2796-1159-0x000000007F710000-0x000000007F711000-memory.dmp

                      Filesize

                      4KB

                    • memory/3016-239-0x000000007EE60000-0x000000007EE61000-memory.dmp

                      Filesize

                      4KB

                    • memory/3016-213-0x0000000006BA0000-0x0000000006BA1000-memory.dmp

                      Filesize

                      4KB

                    • memory/3016-214-0x0000000006BA2000-0x0000000006BA3000-memory.dmp

                      Filesize

                      4KB

                    • memory/3016-206-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

                      Filesize

                      4KB

                    • memory/3016-205-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

                      Filesize

                      4KB

                    • memory/3256-471-0x0000000004F62000-0x0000000004F63000-memory.dmp

                      Filesize

                      4KB

                    • memory/3256-470-0x0000000004F60000-0x0000000004F61000-memory.dmp

                      Filesize

                      4KB

                    • memory/3256-600-0x000000007EEB0000-0x000000007EEB1000-memory.dmp

                      Filesize

                      4KB

                    • memory/3896-130-0x00000000064A0000-0x00000000064C1000-memory.dmp

                      Filesize

                      132KB

                    • memory/3896-131-0x0000000006540000-0x0000000006541000-memory.dmp

                      Filesize

                      4KB

                    • memory/3896-132-0x0000000006500000-0x0000000006501000-memory.dmp

                      Filesize

                      4KB

                    • memory/3896-133-0x0000000005D21000-0x0000000005D22000-memory.dmp

                      Filesize

                      4KB

                    • memory/3896-129-0x0000000005D20000-0x0000000005D21000-memory.dmp

                      Filesize

                      4KB

                    • memory/3896-128-0x0000000005020000-0x0000000005021000-memory.dmp

                      Filesize

                      4KB

                    • memory/3896-127-0x0000000005140000-0x0000000005141000-memory.dmp

                      Filesize

                      4KB

                    • memory/3896-126-0x0000000004F80000-0x0000000004F81000-memory.dmp

                      Filesize

                      4KB

                    • memory/3896-134-0x0000000006800000-0x000000000680B000-memory.dmp

                      Filesize

                      44KB

                    • memory/3896-125-0x0000000005640000-0x0000000005641000-memory.dmp

                      Filesize

                      4KB

                    • memory/3896-123-0x0000000000010000-0x0000000000011000-memory.dmp

                      Filesize

                      4KB

                    • memory/3896-135-0x0000000008CB0000-0x0000000008CB1000-memory.dmp

                      Filesize

                      4KB