Analysis
- max time kernel
131s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
18/11/2022, 22:45
General
- Target file.exe
- Size 2.8MB
- Sample221118-2pel4abe36
- SHA256 4e9175b772c839c1ee50597212389675e75454092aaa2d59a88ea222dfab24e2
Malware Config
Extracted
-
vidar
-
55.7
-
1679
-
https://t.me/deadftx
-
https://www.tiktok.com/@user6068972597711
-
profile_id
1679
Signatures
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1128-146-0x0000000000D90000-0x000000000156C000-memory.dmp
memory/1128-147-0x00007FF9F2D50000-0x00007FF9F2F45000-memory.dmp
memory/1128-136-0x0000000000D90000-0x000000000156C000-memory.dmp
memory/1128-137-0x00007FF9D3BB0000-0x00007FF9D4671000-memory.dmp
memory/1128-138-0x0000000000D90000-0x000000000156C000-memory.dmp
memory/1128-139-0x0000000000D90000-0x000000000156C000-memory.dmp
memory/1128-140-0x00007FF9F2D50000-0x00007FF9F2F45000-memory.dmp
memory/1128-141-0x00007FF9D3BB0000-0x00007FF9D4671000-memory.dmp
memory/1128-134-0x00007FF9F2D50000-0x00007FF9F2F45000-memory.dmp
memory/1128-148-0x00007FF9D3BB0000-0x00007FF9D4671000-memory.dmp
memory/1128-132-0x0000000000D90000-0x000000000156C000-memory.dmp
memory/3860-145-0x0000000000400000-0x0000000000467000-memory.dmp
memory/3860-142-0x0000000000400000-0x0000000000467000-memory.dmp
memory/3860-144-0x0000000000400000-0x0000000000467000-memory.dmp
memory/3860-149-0x0000000000400000-0x0000000000467000-memory.dmp
memory/3860-150-0x0000000000400000-0x0000000000467000-memory.dmp