Analysis
-
max time kernel
71s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20220718-en -
resource tags
arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system -
submitted
19-07-2022 20:36
Static task
static1
Behavioral task
behavioral1
Sample
4fc7a5ef8cadf53201bb797b48b42f16dac02bdec55c732bed6760ceb695641a.exe
Resource
win7-20220718-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4fc7a5ef8cadf53201bb797b48b42f16dac02bdec55c732bed6760ceb695641a.exe
-
Size
728KB
-
MD5
1d4467ffb1931c08ad2ccb25f495113b
-
SHA1
efd91244076812e16e0b122dfd82901db8e85ca8
-
SHA256
4fc7a5ef8cadf53201bb797b48b42f16dac02bdec55c732bed6760ceb695641a
-
SHA512
986f43cea97a2bd9e415b88808503994bd2791cb6ff75871a1b3820e0a09d3c4c0bb7b56e6770eb124c6740a5de07c970695fe22e5d86069d125ad166285a1b9
Malware Config
Extracted
Family
vidar
Version
41.4
Botnet
936
C2
https://mas.to/@sslam
Attributes
-
profile_id
936
Signatures
-
Vidar Stealer 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3504-131-0x0000000003470000-0x0000000003546000-memory.dmp family_vidar behavioral2/memory/3504-132-0x0000000000400000-0x0000000001729000-memory.dmp family_vidar behavioral2/memory/3504-135-0x0000000003470000-0x0000000003546000-memory.dmp family_vidar behavioral2/memory/3504-136-0x0000000000400000-0x0000000001729000-memory.dmp family_vidar -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2668 3504 WerFault.exe 4fc7a5ef8cadf53201bb797b48b42f16dac02bdec55c732bed6760ceb695641a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fc7a5ef8cadf53201bb797b48b42f16dac02bdec55c732bed6760ceb695641a.exe"C:\Users\Admin\AppData\Local\Temp\4fc7a5ef8cadf53201bb797b48b42f16dac02bdec55c732bed6760ceb695641a.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 10322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3504 -ip 35041⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3504-130-0x00000000019ED000-0x0000000001A69000-memory.dmpFilesize
496KB
-
memory/3504-131-0x0000000003470000-0x0000000003546000-memory.dmpFilesize
856KB
-
memory/3504-132-0x0000000000400000-0x0000000001729000-memory.dmpFilesize
19.2MB
-
memory/3504-133-0x00000000019ED000-0x0000000001A69000-memory.dmpFilesize
496KB
-
memory/3504-134-0x00000000019ED000-0x0000000001A69000-memory.dmpFilesize
496KB
-
memory/3504-135-0x0000000003470000-0x0000000003546000-memory.dmpFilesize
856KB
-
memory/3504-136-0x0000000000400000-0x0000000001729000-memory.dmpFilesize
19.2MB