Analysis

  • max time kernel
    179s
  • max time network
    188s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    08-11-2021 10:07

General

  • Target

    96c9fde29860a0517d7c1c17de547fe6f64022603e400b0aff5166c4cfee2434.exe

  • Size

    7MB

  • MD5

    42fff45c940c819040ca8920fbb405cc

  • SHA1

    753821199880873e232bbe95ab2beb4ad0b6797c

  • SHA256

    96c9fde29860a0517d7c1c17de547fe6f64022603e400b0aff5166c4cfee2434

  • SHA512

    7943f9d50e11fae6e3bc1a2fdf05bf5a1a96e3366948157ae1067e4f7834f692f1d2a59cf7fe4ef13e773596ca5a0ad26d62bbd285412550c01d02c1d4f7a05f

Malware Config

Extracted

Family

vidar

Version

41.5

Botnet

933

C2

https://mas.to/@xeroxxx

Attributes
  • profile_id

    933

Signatures

  • Process spawned unexpected child process ⋅ 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess ⋅ 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE ClipBanker Variant Activity (POST)

    suricata: ET MALWARE ClipBanker Variant Activity (POST)

  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Vidar Stealer ⋅ 2 IoCs
  • XMRig Miner Payload ⋅ 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE ⋅ 38 IoCs
  • Checks computer location settings ⋅ 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL ⋅ 64 IoCs
  • Adds Run key to start application ⋅ 2 TTPs 2 IoCs
  • Checks installed software on the system ⋅ 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 ⋅ 1 TTPs
  • Looks up external IP address via web service ⋅ 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory ⋅ 6 IoCs
  • Suspicious use of SetThreadContext ⋅ 2 IoCs
  • Drops file in Program Files directory ⋅ 8 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash ⋅ 1 IoCs
  • NSIS installer ⋅ 8 IoCs
  • Checks processor information in registry ⋅ 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) ⋅ 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Kills process with taskkill ⋅ 2 IoCs
  • Modifies data under HKEY_USERS ⋅ 16 IoCs
  • Modifies registry class ⋅ 16 IoCs