Analysis
-
max time kernel
43s -
max time network
106s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-10-2022 08:57
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
318KB
-
MD5
e58c70e8e2cde5c7aee3975db0a2e559
-
SHA1
4c88ba2a9c7cd614c74fdb34d17ee5d82fc6a4fe
-
SHA256
2a929266c1c731452ab4171a4c6cb980d6c84a6cc81e2bec5b1dacec075113bf
-
SHA512
b4a49e871630b96e94833ca794c2982e96ceb03052fcfbe58e7b3c7e2868a5d2f837f0ed8173bef0b22ba38be28ec22584fabd0d199b0706ae71b9481880adf8
-
SSDEEP
6144:0gqL0tcc42sJfwLJBd9wEu6bxAfcdbr9syJM9GTQtbUxQWm0vMEl:0votci1zjw9QrdFsyMOmFEl
Malware Config
Extracted
vidar
55.2
937
https://t.me/slivetalks
https://c.im/@xinibin420
-
profile_id
937
Signatures
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
Processes:
cmd.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
17839850657982333983.exeCert.exepid process 1780 17839850657982333983.exe 1612 Cert.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2028 cmd.exe -
Loads dropped DLL 13 IoCs
Processes:
file.exe17839850657982333983.exeWerFault.exepid process 1608 file.exe 1608 file.exe 1608 file.exe 1608 file.exe 1608 file.exe 1608 file.exe 1608 file.exe 1780 17839850657982333983.exe 536 WerFault.exe 536 WerFault.exe 536 WerFault.exe 536 WerFault.exe 536 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 536 1612 WerFault.exe Cert.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString file.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1488 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
file.exeCert.exepid process 1608 file.exe 1612 Cert.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Cert.exedescription pid process Token: SeDebugPrivilege 1612 Cert.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
17839850657982333983.exepid process 1780 17839850657982333983.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
file.exe17839850657982333983.execmd.exeCert.exedescription pid process target process PID 1608 wrote to memory of 1780 1608 file.exe 17839850657982333983.exe PID 1608 wrote to memory of 1780 1608 file.exe 17839850657982333983.exe PID 1608 wrote to memory of 1780 1608 file.exe 17839850657982333983.exe PID 1608 wrote to memory of 1780 1608 file.exe 17839850657982333983.exe PID 1608 wrote to memory of 1780 1608 file.exe 17839850657982333983.exe PID 1608 wrote to memory of 1780 1608 file.exe 17839850657982333983.exe PID 1608 wrote to memory of 1780 1608 file.exe 17839850657982333983.exe PID 1780 wrote to memory of 1508 1780 17839850657982333983.exe cmd.exe PID 1780 wrote to memory of 1508 1780 17839850657982333983.exe cmd.exe PID 1780 wrote to memory of 1508 1780 17839850657982333983.exe cmd.exe PID 1780 wrote to memory of 1508 1780 17839850657982333983.exe cmd.exe PID 1608 wrote to memory of 2028 1608 file.exe cmd.exe PID 1608 wrote to memory of 2028 1608 file.exe cmd.exe PID 1608 wrote to memory of 2028 1608 file.exe cmd.exe PID 1608 wrote to memory of 2028 1608 file.exe cmd.exe PID 1780 wrote to memory of 1612 1780 17839850657982333983.exe Cert.exe PID 1780 wrote to memory of 1612 1780 17839850657982333983.exe Cert.exe PID 1780 wrote to memory of 1612 1780 17839850657982333983.exe Cert.exe PID 1780 wrote to memory of 1612 1780 17839850657982333983.exe Cert.exe PID 2028 wrote to memory of 1488 2028 cmd.exe timeout.exe PID 2028 wrote to memory of 1488 2028 cmd.exe timeout.exe PID 2028 wrote to memory of 1488 2028 cmd.exe timeout.exe PID 2028 wrote to memory of 1488 2028 cmd.exe timeout.exe PID 1612 wrote to memory of 536 1612 Cert.exe WerFault.exe PID 1612 wrote to memory of 536 1612 Cert.exe WerFault.exe PID 1612 wrote to memory of 536 1612 Cert.exe WerFault.exe PID 1612 wrote to memory of 536 1612 Cert.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\17839850657982333983.exe"C:\ProgramData\17839850657982333983.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FilesH.bat" "3⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cert.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cert.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 11684⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\17839850657982333983.exeFilesize
377KB
MD5de45c35d825037562691bf4966baa877
SHA134d5ce24da23e95eede66f7eb03f643c9f1fc6fc
SHA256d2702be16de20ee796d1c38ce9f7636b3327b648cdb4bd77823fba908d481c48
SHA512c0ce84055656b576fd5c597aea063844f0227a1940eb64e4fe1c7bc4e5bdff0a06a7abbd8d3c4c18017337b44828c262ecebaf948a17e1e9d5a253c53de152ef
-
C:\ProgramData\17839850657982333983.exeFilesize
377KB
MD5de45c35d825037562691bf4966baa877
SHA134d5ce24da23e95eede66f7eb03f643c9f1fc6fc
SHA256d2702be16de20ee796d1c38ce9f7636b3327b648cdb4bd77823fba908d481c48
SHA512c0ce84055656b576fd5c597aea063844f0227a1940eb64e4fe1c7bc4e5bdff0a06a7abbd8d3c4c18017337b44828c262ecebaf948a17e1e9d5a253c53de152ef
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cert.exeFilesize
275KB
MD5119ee6d6dcfa21f32dd9db95b365f256
SHA142d7f74eab4682928b03e577e2f5b9e6a2d95356
SHA256ca128762eff2a68d3c319bd81574e423c79f59b1e445646ebe83b9c2135c5146
SHA512cb4b8a2f037f1e0ab6a06094895ce9afffaaa428142c63259fa4d899ea53e06c581f5379156bb5f5c577daec8ed8d3e4e315d504771176f2c1a9fb8904a54b7e
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cert.exeFilesize
275KB
MD5119ee6d6dcfa21f32dd9db95b365f256
SHA142d7f74eab4682928b03e577e2f5b9e6a2d95356
SHA256ca128762eff2a68d3c319bd81574e423c79f59b1e445646ebe83b9c2135c5146
SHA512cb4b8a2f037f1e0ab6a06094895ce9afffaaa428142c63259fa4d899ea53e06c581f5379156bb5f5c577daec8ed8d3e4e315d504771176f2c1a9fb8904a54b7e
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FilesH.batFilesize
355B
MD5dd02458f6895094a339f406307325786
SHA13fc884aa1813ff64b3e0a9811158c4dbd8bf7736
SHA2568e5b9aebf24078dc03e2a18c802127eb66bde2cda4d42740b9082bb1a888b787
SHA512b2bb96803b53f3d4b6e318268e8fe76bc5340b7bbe01287c0d526caf1ab54747692491df0c2b3684cf30eaa49ab2bbf65ebeec5099c8b82709044116c9bc6e73
-
\ProgramData\17839850657982333983.exeFilesize
377KB
MD5de45c35d825037562691bf4966baa877
SHA134d5ce24da23e95eede66f7eb03f643c9f1fc6fc
SHA256d2702be16de20ee796d1c38ce9f7636b3327b648cdb4bd77823fba908d481c48
SHA512c0ce84055656b576fd5c597aea063844f0227a1940eb64e4fe1c7bc4e5bdff0a06a7abbd8d3c4c18017337b44828c262ecebaf948a17e1e9d5a253c53de152ef
-
\ProgramData\17839850657982333983.exeFilesize
377KB
MD5de45c35d825037562691bf4966baa877
SHA134d5ce24da23e95eede66f7eb03f643c9f1fc6fc
SHA256d2702be16de20ee796d1c38ce9f7636b3327b648cdb4bd77823fba908d481c48
SHA512c0ce84055656b576fd5c597aea063844f0227a1940eb64e4fe1c7bc4e5bdff0a06a7abbd8d3c4c18017337b44828c262ecebaf948a17e1e9d5a253c53de152ef
-
\ProgramData\17839850657982333983.exeFilesize
377KB
MD5de45c35d825037562691bf4966baa877
SHA134d5ce24da23e95eede66f7eb03f643c9f1fc6fc
SHA256d2702be16de20ee796d1c38ce9f7636b3327b648cdb4bd77823fba908d481c48
SHA512c0ce84055656b576fd5c597aea063844f0227a1940eb64e4fe1c7bc4e5bdff0a06a7abbd8d3c4c18017337b44828c262ecebaf948a17e1e9d5a253c53de152ef
-
\ProgramData\17839850657982333983.exeFilesize
377KB
MD5de45c35d825037562691bf4966baa877
SHA134d5ce24da23e95eede66f7eb03f643c9f1fc6fc
SHA256d2702be16de20ee796d1c38ce9f7636b3327b648cdb4bd77823fba908d481c48
SHA512c0ce84055656b576fd5c597aea063844f0227a1940eb64e4fe1c7bc4e5bdff0a06a7abbd8d3c4c18017337b44828c262ecebaf948a17e1e9d5a253c53de152ef
-
\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
\ProgramData\sqlite3.dllFilesize
1.1MB
MD51f44d4d3087c2b202cf9c90ee9d04b0f
SHA1106a3ebc9e39ab6ddb3ff987efb6527c956f192d
SHA2564841020c8bd06b08fde6e44cbe2e2ab33439e1c8368e936ec5b00dc0584f7260
SHA512b614c72a3c1ce681ebffa628e29aa50275cc80ca9267380960c5198ea4d0a3f2df6cfb7275491d220bad72f14fc94e6656501e9a061d102fb11e00cfda2beb45
-
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cert.exeFilesize
275KB
MD5119ee6d6dcfa21f32dd9db95b365f256
SHA142d7f74eab4682928b03e577e2f5b9e6a2d95356
SHA256ca128762eff2a68d3c319bd81574e423c79f59b1e445646ebe83b9c2135c5146
SHA512cb4b8a2f037f1e0ab6a06094895ce9afffaaa428142c63259fa4d899ea53e06c581f5379156bb5f5c577daec8ed8d3e4e315d504771176f2c1a9fb8904a54b7e
-
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cert.exeFilesize
275KB
MD5119ee6d6dcfa21f32dd9db95b365f256
SHA142d7f74eab4682928b03e577e2f5b9e6a2d95356
SHA256ca128762eff2a68d3c319bd81574e423c79f59b1e445646ebe83b9c2135c5146
SHA512cb4b8a2f037f1e0ab6a06094895ce9afffaaa428142c63259fa4d899ea53e06c581f5379156bb5f5c577daec8ed8d3e4e315d504771176f2c1a9fb8904a54b7e
-
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cert.exeFilesize
275KB
MD5119ee6d6dcfa21f32dd9db95b365f256
SHA142d7f74eab4682928b03e577e2f5b9e6a2d95356
SHA256ca128762eff2a68d3c319bd81574e423c79f59b1e445646ebe83b9c2135c5146
SHA512cb4b8a2f037f1e0ab6a06094895ce9afffaaa428142c63259fa4d899ea53e06c581f5379156bb5f5c577daec8ed8d3e4e315d504771176f2c1a9fb8904a54b7e
-
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cert.exeFilesize
275KB
MD5119ee6d6dcfa21f32dd9db95b365f256
SHA142d7f74eab4682928b03e577e2f5b9e6a2d95356
SHA256ca128762eff2a68d3c319bd81574e423c79f59b1e445646ebe83b9c2135c5146
SHA512cb4b8a2f037f1e0ab6a06094895ce9afffaaa428142c63259fa4d899ea53e06c581f5379156bb5f5c577daec8ed8d3e4e315d504771176f2c1a9fb8904a54b7e
-
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cert.exeFilesize
275KB
MD5119ee6d6dcfa21f32dd9db95b365f256
SHA142d7f74eab4682928b03e577e2f5b9e6a2d95356
SHA256ca128762eff2a68d3c319bd81574e423c79f59b1e445646ebe83b9c2135c5146
SHA512cb4b8a2f037f1e0ab6a06094895ce9afffaaa428142c63259fa4d899ea53e06c581f5379156bb5f5c577daec8ed8d3e4e315d504771176f2c1a9fb8904a54b7e
-
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cert.exeFilesize
275KB
MD5119ee6d6dcfa21f32dd9db95b365f256
SHA142d7f74eab4682928b03e577e2f5b9e6a2d95356
SHA256ca128762eff2a68d3c319bd81574e423c79f59b1e445646ebe83b9c2135c5146
SHA512cb4b8a2f037f1e0ab6a06094895ce9afffaaa428142c63259fa4d899ea53e06c581f5379156bb5f5c577daec8ed8d3e4e315d504771176f2c1a9fb8904a54b7e
-
memory/536-84-0x0000000000000000-mapping.dmp
-
memory/1488-78-0x0000000000000000-mapping.dmp
-
memory/1508-71-0x0000000000000000-mapping.dmp
-
memory/1608-56-0x0000000000308000-0x0000000000334000-memory.dmpFilesize
176KB
-
memory/1608-73-0x0000000000308000-0x0000000000334000-memory.dmpFilesize
176KB
-
memory/1608-55-0x0000000075A91000-0x0000000075A93000-memory.dmpFilesize
8KB
-
memory/1608-80-0x0000000000400000-0x0000000002C3D000-memory.dmpFilesize
40.2MB
-
memory/1608-57-0x00000000001B0000-0x00000000001F9000-memory.dmpFilesize
292KB
-
memory/1608-58-0x0000000000400000-0x0000000002C3D000-memory.dmpFilesize
40.2MB
-
memory/1608-54-0x0000000000308000-0x0000000000334000-memory.dmpFilesize
176KB
-
memory/1612-76-0x0000000000000000-mapping.dmp
-
memory/1612-81-0x0000000001340000-0x000000000138A000-memory.dmpFilesize
296KB
-
memory/1612-82-0x0000000004790000-0x0000000004840000-memory.dmpFilesize
704KB
-
memory/1780-70-0x0000000073D41000-0x0000000073D43000-memory.dmpFilesize
8KB
-
memory/1780-66-0x0000000000000000-mapping.dmp
-
memory/2028-72-0x0000000000000000-mapping.dmp