Analysis
-
max time kernel
270s -
max time network
374s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 11:22
General
-
Target
npp.8.4.7.Installer.x64/npp.8.4.7.Installer.x64.exe
-
Size
555.0MB
-
MD5
4d556911a3a2c22dbd35f381ed7d9dbb
-
SHA1
9439c5dc5dab13d38c279454d5a16e580599700a
-
SHA256
7f9202f5ee95364f2df5bbc6563548667f314678f0561eb052524d5103ec4b00
-
SHA512
f8c275a1839ec498eeaaa8f59ad394ba860474bf4a3e7cc581713e6be4bf13c69acfef921a4b878bad1d49eee22f5cac89aeab3341fdb28349dee2508544f612
-
SSDEEP
3072:DJ6pgZGjXpoGoByXPQs2UTXQ8yb7aFcqiSIvF68KJ9oEZqc:DJOgZGbpYByPT7lyvIcTSIvF68KIc
Malware Config
Extracted
vidar
55.8
1340
https://t.me/headshotsonly
https://steamcommunity.com/profiles/76561199436777531
-
profile_id
1340
Signatures
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\npp.8.4.7.Installer.x64\npp.8.4.7.Installer.x64.exe"C:\Users\Admin\AppData\Local\Temp\npp.8.4.7.Installer.x64\npp.8.4.7.Installer.x64.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Obzuaolnpp.8.4.7.installer.x64.exe"C:\Users\Admin\AppData\Local\Temp\Obzuaolnpp.8.4.7.installer.x64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\npp.8.4.7.Installer.x64\npp.8.4.7.Installer.x64.exeC:\Users\Admin\AppData\Local\Temp\npp.8.4.7.Installer.x64\npp.8.4.7.Installer.x64.exe2⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.4MB
MD5feaa91429fb314271bb2cd3db61bcb8a
SHA150758c9bea853caceddaf49dfbed82db8a72d994
SHA256515d2c71ece7c4c7432794b9e1bb6fcf60fdaa2e499744c09af113c65d6dbb68
SHA512fa0a891be025fc207a02018d82d85360f4653c10b414bcc7f175550d992bfefe39dbdbe23b1a848720ee595ae2745e9b9fb171ad2da1eef526ae3ada0fff3ef8
-
Filesize
4.4MB
MD5feaa91429fb314271bb2cd3db61bcb8a
SHA150758c9bea853caceddaf49dfbed82db8a72d994
SHA256515d2c71ece7c4c7432794b9e1bb6fcf60fdaa2e499744c09af113c65d6dbb68
SHA512fa0a891be025fc207a02018d82d85360f4653c10b414bcc7f175550d992bfefe39dbdbe23b1a848720ee595ae2745e9b9fb171ad2da1eef526ae3ada0fff3ef8
-
Filesize
5KB
MD568b287f4067ba013e34a1339afdb1ea8
SHA145ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA25618e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
SHA51206c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
-
Filesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
136KB
-
Filesize
192KB
-
Filesize
6.2MB
-
Filesize
408KB
-
Filesize
104KB
-
Filesize
120KB
-
Filesize
408KB
-
-
Filesize
216KB
-
Filesize
6.5MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
380KB
-
-
Filesize
380KB
-
Filesize
972KB