Analysis
-
max time kernel
94s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-06-2022 15:08
Static task
static1
Behavioral task
behavioral1
Sample
2932ffbdc56db8c83bbbafc1837e53518639c055c10e2d244afb1c21bc07d399.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
2932ffbdc56db8c83bbbafc1837e53518639c055c10e2d244afb1c21bc07d399.exe
-
Size
717KB
-
MD5
18072775678092c74cb362a3ac7dc7de
-
SHA1
5b2d731d7dbd59f4512807c273cea23e09c7f195
-
SHA256
2932ffbdc56db8c83bbbafc1837e53518639c055c10e2d244afb1c21bc07d399
-
SHA512
3420b4e86caf33a0540f05413d60a16f9ce4856257a0c4bae91e3f8c80529c2bd9c7f250e286c6e469da552fcc8f1ee8f1caede7b323597387da6dec2de2dce0
Malware Config
Extracted
Family
vidar
Version
41.5
Botnet
937
C2
https://mas.to/@xeroxxx
Attributes
-
profile_id
937
Signatures
-
Vidar Stealer 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4164-131-0x0000000000D30000-0x0000000000E06000-memory.dmp family_vidar behavioral2/memory/4164-132-0x0000000000400000-0x00000000008E3000-memory.dmp family_vidar behavioral2/memory/4164-134-0x0000000000D30000-0x0000000000E06000-memory.dmp family_vidar behavioral2/memory/4164-135-0x0000000000400000-0x00000000008E3000-memory.dmp family_vidar -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4408 4164 WerFault.exe 2932ffbdc56db8c83bbbafc1837e53518639c055c10e2d244afb1c21bc07d399.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2932ffbdc56db8c83bbbafc1837e53518639c055c10e2d244afb1c21bc07d399.exe"C:\Users\Admin\AppData\Local\Temp\2932ffbdc56db8c83bbbafc1837e53518639c055c10e2d244afb1c21bc07d399.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 9242⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4164 -ip 41641⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4164-130-0x0000000000AF9000-0x0000000000B75000-memory.dmpFilesize
496KB
-
memory/4164-131-0x0000000000D30000-0x0000000000E06000-memory.dmpFilesize
856KB
-
memory/4164-132-0x0000000000400000-0x00000000008E3000-memory.dmpFilesize
4.9MB
-
memory/4164-133-0x0000000000AF9000-0x0000000000B75000-memory.dmpFilesize
496KB
-
memory/4164-134-0x0000000000D30000-0x0000000000E06000-memory.dmpFilesize
856KB
-
memory/4164-135-0x0000000000400000-0x00000000008E3000-memory.dmpFilesize
4.9MB
-
memory/4164-136-0x0000000000AF9000-0x0000000000B75000-memory.dmpFilesize
496KB