Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14-06-2022 15:09
Static task
static1
Behavioral task
behavioral1
Sample
3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe
Resource
win7-20220414-en
General
-
Target
3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe
-
Size
298KB
-
MD5
9c7bd483a0404af97cbf390fddb9c281
-
SHA1
e2371b4388c2782566b80c93044810738b62f2a0
-
SHA256
3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff
-
SHA512
aa2a1191cf72fe731b563ee3cf8b5f8b932ecefd60a8ab2fa5412a93e8f4e554955af5d1f05593daf7cff2caea4fc801d133ba703a4faee8cdde6c47c4e0a564
Malware Config
Extracted
arkei
Default
Signatures
-
suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1524 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exepid process 904 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe 904 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exedescription pid process target process PID 1600 set thread context of 904 1600 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1532 timeout.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.execmd.exedescription pid process target process PID 1600 wrote to memory of 904 1600 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe PID 1600 wrote to memory of 904 1600 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe PID 1600 wrote to memory of 904 1600 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe PID 1600 wrote to memory of 904 1600 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe PID 1600 wrote to memory of 904 1600 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe PID 1600 wrote to memory of 904 1600 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe PID 1600 wrote to memory of 904 1600 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe PID 1600 wrote to memory of 904 1600 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe PID 1600 wrote to memory of 904 1600 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe PID 1600 wrote to memory of 904 1600 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe PID 1600 wrote to memory of 904 1600 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe PID 904 wrote to memory of 1524 904 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe cmd.exe PID 904 wrote to memory of 1524 904 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe cmd.exe PID 904 wrote to memory of 1524 904 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe cmd.exe PID 904 wrote to memory of 1524 904 3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe cmd.exe PID 1524 wrote to memory of 1532 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 1532 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 1532 1524 cmd.exe timeout.exe PID 1524 wrote to memory of 1532 1524 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe"C:\Users\Admin\AppData\Local\Temp\3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe"C:\Users\Admin\AppData\Local\Temp\3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\3ad16c5735e6497666415d0621736d71b66e624beb012d06bf9fda66b09cdcff.exe" & exit3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\ProgramData\mozglue.dllFilesize
133KB
MD58f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
\ProgramData\nss3.dllFilesize
1.2MB
MD5bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
memory/904-61-0x0000000075CD1000-0x0000000075CD3000-memory.dmpFilesize
8KB
-
memory/904-58-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/904-60-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/904-54-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/904-62-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/904-55-0x000000000043C0B2-mapping.dmp
-
memory/904-84-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1524-83-0x0000000000000000-mapping.dmp
-
memory/1532-85-0x0000000000000000-mapping.dmp
-
memory/1600-59-0x0000000000230000-0x000000000025A000-memory.dmpFilesize
168KB
-
memory/1600-57-0x000000000083E000-0x000000000085E000-memory.dmpFilesize
128KB