Analysis

  • max time kernel
    126s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-11-2022 09:18

General

  • Target

    f4a2a8a7d1d2c7b26f4e54ca2612f71a.exe

  • Size

    1.2MB

  • MD5

    f4a2a8a7d1d2c7b26f4e54ca2612f71a

  • SHA1

    744fadee7a1e67bee2cf1a534a63483ab1d2e3f8

  • SHA256

    9d5670638fac6e9e5670cd6985894e9b2fcf1fb334973e5e3424fb246f835e11

  • SHA512

    4432c4f8cdfb4b36eb7f6b8794348bce1ecc06709ceb2a804998b1685d22f5f539134dc6e1df95b9834390a06ff8eb804f5bbd517522e6f4b0afa7374a4cd9c5

  • SSDEEP

    24576:QolGO8/6YpXCGf+SK/ftRnMh9+bTLWdaVom4v7FM:Q0GL6YpZmSat5LWdNhM

Malware Config

Extracted

Family

systembc

C2

89.22.225.242:4193

195.2.93.22:4193

Extracted

Family

vidar

Version

55.7

Botnet

1754

C2

https://t.me/deadftx

https://www.ultimate-guitar.com/u/smbfupkuhrgc1

Attributes
  • profile_id

    1754

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\taskhostw.exe
    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
    1⤵
      PID:2492
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:4768
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\svchost.exe" & exit
          3⤵
            PID:4772
            • C:\Windows\SysWOW64\timeout.exe
              timeout /t 6
              4⤵
              • Delays execution with timeout.exe
              PID:3052
      • C:\Users\Admin\AppData\Local\Temp\f4a2a8a7d1d2c7b26f4e54ca2612f71a.exe
        "C:\Users\Admin\AppData\Local\Temp\f4a2a8a7d1d2c7b26f4e54ca2612f71a.exe"
        1⤵
        • Checks computer location settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4432
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\goxijag kaqu rabojer\fofew gequa botovib moca loja faromemo sow nexonide hete.exe"
          2⤵
          • Creates scheduled task(s)
          PID:2600
        • C:\Users\Admin\goxijag kaqu rabojer\fofew gequa botovib moca loja faromemo sow nexonide hete.exe
          "C:\Users\Admin\goxijag kaqu rabojer\fofew gequa botovib moca loja faromemo sow nexonide hete.exe"
          2⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4188
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
            3⤵
              PID:3452
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\f4a2a8a7d1d2c7b26f4e54ca2612f71a.exe"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4308
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              3⤵
                PID:4148
              • C:\Windows\SysWOW64\PING.EXE
                ping 127.0.0.1
                3⤵
                • Runs ping.exe
                PID:1784

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Execution

          Scheduled Task

          1
          T1053

          Persistence

          Scheduled Task

          1
          T1053

          Privilege Escalation

          Scheduled Task

          1
          T1053

          Defense Evasion

          Install Root Certificate

          1
          T1130

          Modify Registry

          1
          T1112

          Credential Access

          Credentials in Files

          1
          T1081

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          2
          T1082

          Remote System Discovery

          1
          T1018

          Collection

          Data from Local System

          1
          T1005

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\mozglue.dll
            Filesize

            593KB

            MD5

            c8fd9be83bc728cc04beffafc2907fe9

            SHA1

            95ab9f701e0024cedfbd312bcfe4e726744c4f2e

            SHA256

            ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

            SHA512

            fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

          • C:\ProgramData\nss3.dll
            Filesize

            2.0MB

            MD5

            1cc453cdf74f31e4d913ff9c10acdde2

            SHA1

            6e85eae544d6e965f15fa5c39700fa7202f3aafe

            SHA256

            ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

            SHA512

            dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

          • C:\Users\Admin\AppData\Local\Temp\advapi32.dll
            Filesize

            428KB

            MD5

            4880886732471a6abbb919b2d9c94e03

            SHA1

            78d331eeff674b95bf5d9756a0da7c60b0dee7b4

            SHA256

            c1f5411008304f15bcc5fa281bd9ee8eae70948f2a58db190290adaf259dcee0

            SHA512

            b755b402d051d6ff777249ba5eb4754eeeb2a2c47baeb1d69dac3b7e67e88aa5ef83027a41fbfaf7e170cb2ec0f15065d8bb529f989fb15319d4c143b4900432

          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            Filesize

            1.8MB

            MD5

            e716ffae131666d5e0e77e5d479b1e37

            SHA1

            42fea83d3a19beecb25d2c5bd46e547bb4a09319

            SHA256

            32684b073e05d41b49611a2d49f25d4d53ca8182d5de134bc7a4924158bc577b

            SHA512

            c559c52b40c5b593e0687d05c9ed54229b0eb62a517940caaecc6d09aa4d21bdc129552cfcd31509e4f5c35be069ee617457ce047460cc6a23270499ca14f75c

          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            Filesize

            1.8MB

            MD5

            e716ffae131666d5e0e77e5d479b1e37

            SHA1

            42fea83d3a19beecb25d2c5bd46e547bb4a09319

            SHA256

            32684b073e05d41b49611a2d49f25d4d53ca8182d5de134bc7a4924158bc577b

            SHA512

            c559c52b40c5b593e0687d05c9ed54229b0eb62a517940caaecc6d09aa4d21bdc129552cfcd31509e4f5c35be069ee617457ce047460cc6a23270499ca14f75c

          • C:\Users\Admin\goxijag kaqu rabojer\fofew gequa botovib moca loja faromemo sow nexonide hete.exe
            Filesize

            351.6MB

            MD5

            19c27d8d837e71ce5cdf09da138a913c

            SHA1

            f8c0f5637d19f8b3860530c1ec93e3012f1ce150

            SHA256

            830c3476080fa48c445feaa8ad458a0b633e32f5c773d2ba63f065df949c7c66

            SHA512

            83d6594d71f220749d496dde88ae18df0d99b00eb36ab71081a21faacc1df1018cb6f0720a9a78c2afe0c25ecc83e4c703b750cd193e5f10b64a03b8211826fd

          • C:\Users\Admin\goxijag kaqu rabojer\fofew gequa botovib moca loja faromemo sow nexonide hete.exe
            Filesize

            325.9MB

            MD5

            29db6e7a232c3a6c36e2e079721434e3

            SHA1

            a29d1c10ed5c346a1a5c8bacd3aeebb9290b0b30

            SHA256

            5ae5315f88f10587acd7e47757437e227adef49a876aa4a36b298eafb1294509

            SHA512

            b76cba2db5e979e30ace9eb72acfde684009dfca07a6fcf90ceb8aab8c625f63d6ed0150082227a91c823e30e6e705bc6df96134eb57761f7a57909861dcedd0

          • memory/1784-143-0x0000000000000000-mapping.dmp
          • memory/2600-136-0x0000000000000000-mapping.dmp
          • memory/3052-195-0x0000000000000000-mapping.dmp
          • memory/3452-150-0x0000000000000000-mapping.dmp
          • memory/3452-155-0x0000000000400000-0x0000000000407000-memory.dmp
            Filesize

            28KB

          • memory/3452-153-0x0000000000400000-0x0000000000407000-memory.dmp
            Filesize

            28KB

          • memory/3452-151-0x0000000000400000-0x0000000000407000-memory.dmp
            Filesize

            28KB

          • memory/4148-142-0x0000000000000000-mapping.dmp
          • memory/4188-144-0x0000000002F2D000-0x0000000003414000-memory.dmp
            Filesize

            4.9MB

          • memory/4188-148-0x000000000F6D0000-0x000000000F71B000-memory.dmp
            Filesize

            300KB

          • memory/4188-149-0x000000000F6D0000-0x000000000F71B000-memory.dmp
            Filesize

            300KB

          • memory/4188-147-0x0000000002DDE000-0x0000000002ED4000-memory.dmp
            Filesize

            984KB

          • memory/4188-146-0x0000000002F2D000-0x0000000003414000-memory.dmp
            Filesize

            4.9MB

          • memory/4188-145-0x0000000002DDE000-0x0000000002ED4000-memory.dmp
            Filesize

            984KB

          • memory/4188-137-0x0000000000000000-mapping.dmp
          • memory/4188-159-0x0000000002DDE000-0x0000000002ED4000-memory.dmp
            Filesize

            984KB

          • memory/4308-140-0x0000000000000000-mapping.dmp
          • memory/4432-135-0x0000000002C92000-0x0000000002D88000-memory.dmp
            Filesize

            984KB

          • memory/4432-132-0x000000000279E000-0x0000000002C85000-memory.dmp
            Filesize

            4.9MB

          • memory/4432-133-0x0000000002C92000-0x0000000002D88000-memory.dmp
            Filesize

            984KB

          • memory/4432-141-0x0000000002C92000-0x0000000002D88000-memory.dmp
            Filesize

            984KB

          • memory/4432-134-0x000000000279E000-0x0000000002C85000-memory.dmp
            Filesize

            4.9MB

          • memory/4768-167-0x000000000F9C0000-0x000000000FA1F000-memory.dmp
            Filesize

            380KB

          • memory/4768-163-0x0000000002E00000-0x0000000002F24000-memory.dmp
            Filesize

            1.1MB

          • memory/4768-165-0x000000000FA20000-0x000000000FD4A000-memory.dmp
            Filesize

            3.2MB

          • memory/4768-166-0x000000000FA20000-0x000000000FD4A000-memory.dmp
            Filesize

            3.2MB

          • memory/4768-157-0x0000000000000000-mapping.dmp
          • memory/4768-170-0x0000000061E00000-0x0000000061EF3000-memory.dmp
            Filesize

            972KB

          • memory/4768-162-0x0000000002800000-0x0000000002DCB000-memory.dmp
            Filesize

            5.8MB

          • memory/4768-164-0x0000000077100000-0x00000000772A3000-memory.dmp
            Filesize

            1.6MB

          • memory/4768-191-0x0000000002800000-0x00000000029A3000-memory.dmp
            Filesize

            1.6MB

          • memory/4768-193-0x0000000077100000-0x00000000772A3000-memory.dmp
            Filesize

            1.6MB

          • memory/4768-192-0x0000000002E00000-0x0000000002F24000-memory.dmp
            Filesize

            1.1MB

          • memory/4768-194-0x000000000FA20000-0x000000000FD4A000-memory.dmp
            Filesize

            3.2MB

          • memory/4768-161-0x0000000077100000-0x00000000772A3000-memory.dmp
            Filesize

            1.6MB

          • memory/4768-160-0x0000000002800000-0x0000000002DCB000-memory.dmp
            Filesize

            5.8MB

          • memory/4772-190-0x0000000000000000-mapping.dmp