Analysis
-
max time kernel
126s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
resource tags
arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2022 15:04
Static task
static1
Behavioral task
behavioral1
Sample
4f385cf218fe05b153e2dad071522c780f8959fcd2b61606d27e59d202fcb4f5.exe
Resource
win7-20220718-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4f385cf218fe05b153e2dad071522c780f8959fcd2b61606d27e59d202fcb4f5.exe
-
Size
1.9MB
-
MD5
d74e3e939a60460a2e38221e8c5ef2e8
-
SHA1
209f6907cc17b1485605243fd521ee6a6fe4ffcb
-
SHA256
4f385cf218fe05b153e2dad071522c780f8959fcd2b61606d27e59d202fcb4f5
-
SHA512
bd3dd0595ce57f2430f370d4d642aa74c4bef482db8180dc31e74a3b2501ef3686ca638831e5bb8ad5f56e2dc620a7029aba7f607f2021286e41654ac60eac61
Malware Config
Extracted
Family
vidar
Version
50.1
Botnet
1148
C2
https://mastodon.online/@k1llerniax
https://koyu.space/@k1llerni2x
Attributes
-
profile_id
1148
Signatures
-
Vidar Stealer 8 IoCs
Processes:
resource yara_rule behavioral2/memory/3000-132-0x00000000004E0000-0x00000000006AD000-memory.dmp family_vidar behavioral2/memory/3000-133-0x00000000004E0000-0x00000000006AD000-memory.dmp family_vidar behavioral2/memory/3000-136-0x00000000004E0000-0x00000000006AD000-memory.dmp family_vidar behavioral2/memory/3000-137-0x00000000004E0000-0x00000000006AD000-memory.dmp family_vidar behavioral2/memory/3000-139-0x00000000004E0000-0x00000000006AD000-memory.dmp family_vidar behavioral2/memory/3000-140-0x00000000004E0000-0x00000000006AD000-memory.dmp family_vidar behavioral2/memory/3000-142-0x00000000004E0000-0x00000000006AD000-memory.dmp family_vidar behavioral2/memory/3000-144-0x00000000004E0000-0x00000000006AD000-memory.dmp family_vidar -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
4f385cf218fe05b153e2dad071522c780f8959fcd2b61606d27e59d202fcb4f5.exepid process 3000 4f385cf218fe05b153e2dad071522c780f8959fcd2b61606d27e59d202fcb4f5.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4f385cf218fe05b153e2dad071522c780f8959fcd2b61606d27e59d202fcb4f5.exepid process 3000 4f385cf218fe05b153e2dad071522c780f8959fcd2b61606d27e59d202fcb4f5.exe 3000 4f385cf218fe05b153e2dad071522c780f8959fcd2b61606d27e59d202fcb4f5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f385cf218fe05b153e2dad071522c780f8959fcd2b61606d27e59d202fcb4f5.exe"C:\Users\Admin\AppData\Local\Temp\4f385cf218fe05b153e2dad071522c780f8959fcd2b61606d27e59d202fcb4f5.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3000-130-0x00000000004E0000-0x00000000006AD000-memory.dmpFilesize
1.8MB
-
memory/3000-131-0x00000000004E0000-0x00000000006AD000-memory.dmpFilesize
1.8MB
-
memory/3000-132-0x00000000004E0000-0x00000000006AD000-memory.dmpFilesize
1.8MB
-
memory/3000-133-0x00000000004E0000-0x00000000006AD000-memory.dmpFilesize
1.8MB
-
memory/3000-135-0x0000000002440000-0x000000000248C000-memory.dmpFilesize
304KB
-
memory/3000-134-0x0000000075470000-0x0000000075685000-memory.dmpFilesize
2.1MB
-
memory/3000-136-0x00000000004E0000-0x00000000006AD000-memory.dmpFilesize
1.8MB
-
memory/3000-137-0x00000000004E0000-0x00000000006AD000-memory.dmpFilesize
1.8MB
-
memory/3000-139-0x00000000004E0000-0x00000000006AD000-memory.dmpFilesize
1.8MB
-
memory/3000-138-0x0000000076200000-0x0000000076481000-memory.dmpFilesize
2.5MB
-
memory/3000-140-0x00000000004E0000-0x00000000006AD000-memory.dmpFilesize
1.8MB
-
memory/3000-141-0x0000000075960000-0x0000000075A43000-memory.dmpFilesize
908KB
-
memory/3000-142-0x00000000004E0000-0x00000000006AD000-memory.dmpFilesize
1.8MB
-
memory/3000-143-0x0000000002440000-0x000000000248C000-memory.dmpFilesize
304KB
-
memory/3000-144-0x00000000004E0000-0x00000000006AD000-memory.dmpFilesize
1.8MB