Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2022 09:29
Behavioral task
behavioral1
Sample
1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe
Resource
win7-20220901-en
General
-
Target
1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe
-
Size
5.1MB
-
MD5
58c40d0ad81f25bcd68a5523d867eb34
-
SHA1
4066f9bdb046b6feaf612bc7571f8b0f3a1ca169
-
SHA256
1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367
-
SHA512
e43c16f3df411c5bd26a4491be86071c135facfce42a8b48608224060216c6b5552bf7d2fd25eccecd4fea27ad3d2e1e1c7ea03a8999430056ca8a33e29399dd
-
SSDEEP
98304:B5Sn52sYtLDfSR654zrPp8/Rq3ZEVkERxCFJiT0Gu4ueeZT:w4sxR65OpsEZEVjvMJiAMutT
Malware Config
Extracted
vidar
53.4
1364
https://t.me/cheaptrains
https://mastodon.social/@ffolegg94
-
profile_id
1364
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe -
Vidar Stealer 6 IoCs
Processes:
resource yara_rule behavioral2/memory/2088-134-0x0000000000180000-0x00000000006CE000-memory.dmp family_vidar behavioral2/memory/2088-135-0x0000000000180000-0x00000000006CE000-memory.dmp family_vidar behavioral2/memory/2088-136-0x0000000000180000-0x00000000006CE000-memory.dmp family_vidar behavioral2/memory/2088-137-0x0000000000180000-0x00000000006CE000-memory.dmp family_vidar behavioral2/memory/2088-138-0x0000000000180000-0x00000000006CE000-memory.dmp family_vidar behavioral2/memory/2088-140-0x0000000000180000-0x00000000006CE000-memory.dmp family_vidar -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe -
Processes:
resource yara_rule behavioral2/memory/2088-132-0x0000000000180000-0x00000000006CE000-memory.dmp themida behavioral2/memory/2088-133-0x0000000000180000-0x00000000006CE000-memory.dmp themida behavioral2/memory/2088-134-0x0000000000180000-0x00000000006CE000-memory.dmp themida behavioral2/memory/2088-135-0x0000000000180000-0x00000000006CE000-memory.dmp themida behavioral2/memory/2088-136-0x0000000000180000-0x00000000006CE000-memory.dmp themida behavioral2/memory/2088-137-0x0000000000180000-0x00000000006CE000-memory.dmp themida behavioral2/memory/2088-138-0x0000000000180000-0x00000000006CE000-memory.dmp themida behavioral2/memory/2088-140-0x0000000000180000-0x00000000006CE000-memory.dmp themida -
Processes:
1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exepid process 2088 1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exepid process 2088 1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe 2088 1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe"C:\Users\Admin\AppData\Local\Temp\1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2088-132-0x0000000000180000-0x00000000006CE000-memory.dmpFilesize
5.3MB
-
memory/2088-133-0x0000000000180000-0x00000000006CE000-memory.dmpFilesize
5.3MB
-
memory/2088-134-0x0000000000180000-0x00000000006CE000-memory.dmpFilesize
5.3MB
-
memory/2088-135-0x0000000000180000-0x00000000006CE000-memory.dmpFilesize
5.3MB
-
memory/2088-136-0x0000000000180000-0x00000000006CE000-memory.dmpFilesize
5.3MB
-
memory/2088-137-0x0000000000180000-0x00000000006CE000-memory.dmpFilesize
5.3MB
-
memory/2088-138-0x0000000000180000-0x00000000006CE000-memory.dmpFilesize
5.3MB
-
memory/2088-139-0x0000000076EA0000-0x0000000077043000-memory.dmpFilesize
1.6MB
-
memory/2088-140-0x0000000000180000-0x00000000006CE000-memory.dmpFilesize
5.3MB
-
memory/2088-141-0x0000000076EA0000-0x0000000077043000-memory.dmpFilesize
1.6MB