Analysis

  • max time kernel
    511s
  • max time network
    514s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    28-04-2022 07:35

General

  • Target

    vidar.xll

  • Size

    880KB

  • MD5

    4ebc548df517cae4c7e3122e9c75ede6

  • SHA1

    6e19e1e6f3a7b96cf562c2f6768f92580652d427

  • SHA256

    6c67e1ccf77b872b1f3cf257a257d75c4995dc079945080f578b51357ccdbe55

  • SHA512

    359be199470a83ad32db555840c5b33a6b69db96cc188d83d550639fe9fe75464529819fdf0cded9d489cb7ba03802667ac373d3ad2a3f7e4069b023c8508290

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\vidar.xll"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3272
    • C:\Users\Admin\AppData\Roaming\service.exe
      "C:\Users\Admin\AppData\Roaming\service.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1108
      • C:\Users\Admin\AppData\Roaming\service.exe
        "C:\Users\Admin\AppData\Roaming\service.exe"
        3⤵
        • Executes dropped EXE
        PID:2456
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 204
          4⤵
          • Program crash
          PID:4884
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2456 -ip 2456
    1⤵
      PID:4340

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\vidar.xll

      Filesize

      880KB

      MD5

      4ebc548df517cae4c7e3122e9c75ede6

      SHA1

      6e19e1e6f3a7b96cf562c2f6768f92580652d427

      SHA256

      6c67e1ccf77b872b1f3cf257a257d75c4995dc079945080f578b51357ccdbe55

      SHA512

      359be199470a83ad32db555840c5b33a6b69db96cc188d83d550639fe9fe75464529819fdf0cded9d489cb7ba03802667ac373d3ad2a3f7e4069b023c8508290

    • C:\Users\Admin\AppData\Local\Temp\vidar.xll

      Filesize

      880KB

      MD5

      4ebc548df517cae4c7e3122e9c75ede6

      SHA1

      6e19e1e6f3a7b96cf562c2f6768f92580652d427

      SHA256

      6c67e1ccf77b872b1f3cf257a257d75c4995dc079945080f578b51357ccdbe55

      SHA512

      359be199470a83ad32db555840c5b33a6b69db96cc188d83d550639fe9fe75464529819fdf0cded9d489cb7ba03802667ac373d3ad2a3f7e4069b023c8508290

    • C:\Users\Admin\AppData\Roaming\service.exe

      Filesize

      680KB

      MD5

      c20495a19b01f9258ca23d01933ec47e

      SHA1

      1642d96fb066baaa592e6b147e7a40cb49aeb2ba

      SHA256

      61c1436f9b48159b56f1f71561626724682d54e1714ec722c76c3b7667f0cbb7

      SHA512

      b84494e422b2231141836a8ef0bbe04e6fd17c189dcbabacd8b3cbfe9dc5b224dfbefa457fb105f147350b45044e7a0363a101fe008e3610aa066bd379d4ed68

    • C:\Users\Admin\AppData\Roaming\service.exe

      Filesize

      680KB

      MD5

      c20495a19b01f9258ca23d01933ec47e

      SHA1

      1642d96fb066baaa592e6b147e7a40cb49aeb2ba

      SHA256

      61c1436f9b48159b56f1f71561626724682d54e1714ec722c76c3b7667f0cbb7

      SHA512

      b84494e422b2231141836a8ef0bbe04e6fd17c189dcbabacd8b3cbfe9dc5b224dfbefa457fb105f147350b45044e7a0363a101fe008e3610aa066bd379d4ed68

    • C:\Users\Admin\AppData\Roaming\service.exe

      Filesize

      680KB

      MD5

      c20495a19b01f9258ca23d01933ec47e

      SHA1

      1642d96fb066baaa592e6b147e7a40cb49aeb2ba

      SHA256

      61c1436f9b48159b56f1f71561626724682d54e1714ec722c76c3b7667f0cbb7

      SHA512

      b84494e422b2231141836a8ef0bbe04e6fd17c189dcbabacd8b3cbfe9dc5b224dfbefa457fb105f147350b45044e7a0363a101fe008e3610aa066bd379d4ed68

    • memory/3272-135-0x00007FFF775E0000-0x00007FFF775F0000-memory.dmp

      Filesize

      64KB

    • memory/3272-133-0x00007FFF79930000-0x00007FFF79940000-memory.dmp

      Filesize

      64KB

    • memory/3272-136-0x00007FFF775E0000-0x00007FFF775F0000-memory.dmp

      Filesize

      64KB

    • memory/3272-142-0x000001E7FDFCC000-0x000001E7FDFCF000-memory.dmp

      Filesize

      12KB

    • memory/3272-141-0x00007FFF90D20000-0x00007FFF917E1000-memory.dmp

      Filesize

      10.8MB

    • memory/3272-130-0x00007FFF79930000-0x00007FFF79940000-memory.dmp

      Filesize

      64KB

    • memory/3272-134-0x00007FFF79930000-0x00007FFF79940000-memory.dmp

      Filesize

      64KB

    • memory/3272-138-0x000001E7FC610000-0x000001E7FC706000-memory.dmp

      Filesize

      984KB

    • memory/3272-132-0x00007FFF79930000-0x00007FFF79940000-memory.dmp

      Filesize

      64KB

    • memory/3272-131-0x00007FFF79930000-0x00007FFF79940000-memory.dmp

      Filesize

      64KB

    • memory/3272-149-0x00007FFF79930000-0x00007FFF79940000-memory.dmp

      Filesize

      64KB

    • memory/3272-150-0x00007FFF79930000-0x00007FFF79940000-memory.dmp

      Filesize

      64KB

    • memory/3272-151-0x00007FFF79930000-0x00007FFF79940000-memory.dmp

      Filesize

      64KB

    • memory/3272-152-0x00007FFF79930000-0x00007FFF79940000-memory.dmp

      Filesize

      64KB