Analysis
-
max time kernel
147s -
max time network
207s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 07:01
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20221111-en
General
-
Target
Setup.exe
-
Size
870KB
-
MD5
e2d9b6d75e486079765a8c73aa82e52e
-
SHA1
3ef57a6cdc8350240b27e1c832f0292a4a24e823
-
SHA256
2c993eb220436695d78783d2a6520951e4ce2b65311a96b904a063abdc088235
-
SHA512
108164ff8d24e44e4bc5160c876ff64a07f069b1f2be4ff40251f0221bc5f35c7d598292e9770a931204b66bc87fefc87b2a78bfaaebe03f65ba82350a96e3d2
-
SSDEEP
24576:248cD30gdMnJImA0km0HIArQajeT0w+5gmbatBZCI:FIgdMnJImByrQ8eow+5gmYA
Malware Config
Extracted
vidar
55.9
1325
https://t.me/headshotsonly
https://steamcommunity.com/profiles/76561199436777531
-
profile_id
1325
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
86422354719050849345.exepid process 908 86422354719050849345.exe -
Loads dropped DLL 13 IoCs
Processes:
vbc.exe86422354719050849345.exeWerFault.exepid process 1492 vbc.exe 1492 vbc.exe 1492 vbc.exe 1492 vbc.exe 1492 vbc.exe 1492 vbc.exe 908 86422354719050849345.exe 908 86422354719050849345.exe 908 86422354719050849345.exe 908 86422354719050849345.exe 472 WerFault.exe 472 WerFault.exe 472 WerFault.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
Setup.exe86422354719050849345.exedescription pid process target process PID 1172 set thread context of 1492 1172 Setup.exe vbc.exe PID 908 set thread context of 968 908 86422354719050849345.exe vbc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1120 1172 WerFault.exe Setup.exe 472 908 WerFault.exe 86422354719050849345.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 vbc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString vbc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
vbc.exepid process 1492 vbc.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
Setup.exevbc.exe86422354719050849345.exedescription pid process target process PID 1172 wrote to memory of 1492 1172 Setup.exe vbc.exe PID 1172 wrote to memory of 1492 1172 Setup.exe vbc.exe PID 1172 wrote to memory of 1492 1172 Setup.exe vbc.exe PID 1172 wrote to memory of 1492 1172 Setup.exe vbc.exe PID 1172 wrote to memory of 1492 1172 Setup.exe vbc.exe PID 1172 wrote to memory of 1492 1172 Setup.exe vbc.exe PID 1172 wrote to memory of 1492 1172 Setup.exe vbc.exe PID 1172 wrote to memory of 1492 1172 Setup.exe vbc.exe PID 1172 wrote to memory of 1492 1172 Setup.exe vbc.exe PID 1172 wrote to memory of 1120 1172 Setup.exe WerFault.exe PID 1172 wrote to memory of 1120 1172 Setup.exe WerFault.exe PID 1172 wrote to memory of 1120 1172 Setup.exe WerFault.exe PID 1172 wrote to memory of 1120 1172 Setup.exe WerFault.exe PID 1172 wrote to memory of 1120 1172 Setup.exe WerFault.exe PID 1172 wrote to memory of 1120 1172 Setup.exe WerFault.exe PID 1172 wrote to memory of 1120 1172 Setup.exe WerFault.exe PID 1492 wrote to memory of 908 1492 vbc.exe 86422354719050849345.exe PID 1492 wrote to memory of 908 1492 vbc.exe 86422354719050849345.exe PID 1492 wrote to memory of 908 1492 vbc.exe 86422354719050849345.exe PID 1492 wrote to memory of 908 1492 vbc.exe 86422354719050849345.exe PID 1492 wrote to memory of 908 1492 vbc.exe 86422354719050849345.exe PID 1492 wrote to memory of 908 1492 vbc.exe 86422354719050849345.exe PID 1492 wrote to memory of 908 1492 vbc.exe 86422354719050849345.exe PID 908 wrote to memory of 968 908 86422354719050849345.exe vbc.exe PID 908 wrote to memory of 968 908 86422354719050849345.exe vbc.exe PID 908 wrote to memory of 968 908 86422354719050849345.exe vbc.exe PID 908 wrote to memory of 968 908 86422354719050849345.exe vbc.exe PID 908 wrote to memory of 968 908 86422354719050849345.exe vbc.exe PID 908 wrote to memory of 968 908 86422354719050849345.exe vbc.exe PID 908 wrote to memory of 968 908 86422354719050849345.exe vbc.exe PID 908 wrote to memory of 968 908 86422354719050849345.exe vbc.exe PID 908 wrote to memory of 968 908 86422354719050849345.exe vbc.exe PID 908 wrote to memory of 472 908 86422354719050849345.exe WerFault.exe PID 908 wrote to memory of 472 908 86422354719050849345.exe WerFault.exe PID 908 wrote to memory of 472 908 86422354719050849345.exe WerFault.exe PID 908 wrote to memory of 472 908 86422354719050849345.exe WerFault.exe PID 908 wrote to memory of 472 908 86422354719050849345.exe WerFault.exe PID 908 wrote to memory of 472 908 86422354719050849345.exe WerFault.exe PID 908 wrote to memory of 472 908 86422354719050849345.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\86422354719050849345.exe"C:\ProgramData\86422354719050849345.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 364⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 362⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\86422354719050849345.exeFilesize
2.4MB
MD52b467f0545b1981e30aceab51e059e20
SHA165ec505e1a3334d53277c046d5e674bf3c742947
SHA256def5d151079b3b584206933fcac5c5d0e51964a6662e36c9d067c9602f3768dd
SHA5128878025af4bc1d0a6aefb774665f7af41c838eaea082125e8f6f2175b574fcabcd89b7c7d59f693c70357441f11d3e719beda155ee1903a5d7270d890e864613
-
C:\ProgramData\86422354719050849345.exeFilesize
2.4MB
MD52b467f0545b1981e30aceab51e059e20
SHA165ec505e1a3334d53277c046d5e674bf3c742947
SHA256def5d151079b3b584206933fcac5c5d0e51964a6662e36c9d067c9602f3768dd
SHA5128878025af4bc1d0a6aefb774665f7af41c838eaea082125e8f6f2175b574fcabcd89b7c7d59f693c70357441f11d3e719beda155ee1903a5d7270d890e864613
-
C:\ProgramData\MSVCP140.dllFilesize
439KB
MD55ff1fca37c466d6723ec67be93b51442
SHA134cc4e158092083b13d67d6d2bc9e57b798a303b
SHA2565136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA5124802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546
-
C:\ProgramData\VCRUNTIME140.dllFilesize
78KB
MD5a37ee36b536409056a86f50e67777dd7
SHA11cafa159292aa736fc595fc04e16325b27cd6750
SHA2568934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA5123a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
-
\ProgramData\86422354719050849345.exeFilesize
2.4MB
MD52b467f0545b1981e30aceab51e059e20
SHA165ec505e1a3334d53277c046d5e674bf3c742947
SHA256def5d151079b3b584206933fcac5c5d0e51964a6662e36c9d067c9602f3768dd
SHA5128878025af4bc1d0a6aefb774665f7af41c838eaea082125e8f6f2175b574fcabcd89b7c7d59f693c70357441f11d3e719beda155ee1903a5d7270d890e864613
-
\ProgramData\86422354719050849345.exeFilesize
2.4MB
MD52b467f0545b1981e30aceab51e059e20
SHA165ec505e1a3334d53277c046d5e674bf3c742947
SHA256def5d151079b3b584206933fcac5c5d0e51964a6662e36c9d067c9602f3768dd
SHA5128878025af4bc1d0a6aefb774665f7af41c838eaea082125e8f6f2175b574fcabcd89b7c7d59f693c70357441f11d3e719beda155ee1903a5d7270d890e864613
-
\ProgramData\86422354719050849345.exeFilesize
2.4MB
MD52b467f0545b1981e30aceab51e059e20
SHA165ec505e1a3334d53277c046d5e674bf3c742947
SHA256def5d151079b3b584206933fcac5c5d0e51964a6662e36c9d067c9602f3768dd
SHA5128878025af4bc1d0a6aefb774665f7af41c838eaea082125e8f6f2175b574fcabcd89b7c7d59f693c70357441f11d3e719beda155ee1903a5d7270d890e864613
-
\ProgramData\86422354719050849345.exeFilesize
2.4MB
MD52b467f0545b1981e30aceab51e059e20
SHA165ec505e1a3334d53277c046d5e674bf3c742947
SHA256def5d151079b3b584206933fcac5c5d0e51964a6662e36c9d067c9602f3768dd
SHA5128878025af4bc1d0a6aefb774665f7af41c838eaea082125e8f6f2175b574fcabcd89b7c7d59f693c70357441f11d3e719beda155ee1903a5d7270d890e864613
-
\ProgramData\86422354719050849345.exeFilesize
2.4MB
MD52b467f0545b1981e30aceab51e059e20
SHA165ec505e1a3334d53277c046d5e674bf3c742947
SHA256def5d151079b3b584206933fcac5c5d0e51964a6662e36c9d067c9602f3768dd
SHA5128878025af4bc1d0a6aefb774665f7af41c838eaea082125e8f6f2175b574fcabcd89b7c7d59f693c70357441f11d3e719beda155ee1903a5d7270d890e864613
-
\ProgramData\86422354719050849345.exeFilesize
2.4MB
MD52b467f0545b1981e30aceab51e059e20
SHA165ec505e1a3334d53277c046d5e674bf3c742947
SHA256def5d151079b3b584206933fcac5c5d0e51964a6662e36c9d067c9602f3768dd
SHA5128878025af4bc1d0a6aefb774665f7af41c838eaea082125e8f6f2175b574fcabcd89b7c7d59f693c70357441f11d3e719beda155ee1903a5d7270d890e864613
-
\ProgramData\86422354719050849345.exeFilesize
2.4MB
MD52b467f0545b1981e30aceab51e059e20
SHA165ec505e1a3334d53277c046d5e674bf3c742947
SHA256def5d151079b3b584206933fcac5c5d0e51964a6662e36c9d067c9602f3768dd
SHA5128878025af4bc1d0a6aefb774665f7af41c838eaea082125e8f6f2175b574fcabcd89b7c7d59f693c70357441f11d3e719beda155ee1903a5d7270d890e864613
-
\ProgramData\86422354719050849345.exeFilesize
2.4MB
MD52b467f0545b1981e30aceab51e059e20
SHA165ec505e1a3334d53277c046d5e674bf3c742947
SHA256def5d151079b3b584206933fcac5c5d0e51964a6662e36c9d067c9602f3768dd
SHA5128878025af4bc1d0a6aefb774665f7af41c838eaea082125e8f6f2175b574fcabcd89b7c7d59f693c70357441f11d3e719beda155ee1903a5d7270d890e864613
-
\ProgramData\86422354719050849345.exeFilesize
2.4MB
MD52b467f0545b1981e30aceab51e059e20
SHA165ec505e1a3334d53277c046d5e674bf3c742947
SHA256def5d151079b3b584206933fcac5c5d0e51964a6662e36c9d067c9602f3768dd
SHA5128878025af4bc1d0a6aefb774665f7af41c838eaea082125e8f6f2175b574fcabcd89b7c7d59f693c70357441f11d3e719beda155ee1903a5d7270d890e864613
-
\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
\ProgramData\msvcp140.dllFilesize
439KB
MD55ff1fca37c466d6723ec67be93b51442
SHA134cc4e158092083b13d67d6d2bc9e57b798a303b
SHA2565136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA5124802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546
-
\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
\ProgramData\vcruntime140.dllFilesize
78KB
MD5a37ee36b536409056a86f50e67777dd7
SHA11cafa159292aa736fc595fc04e16325b27cd6750
SHA2568934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA5123a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
-
memory/472-116-0x0000000000000000-mapping.dmp
-
memory/908-92-0x0000000000000000-mapping.dmp
-
memory/968-102-0x0000000000400000-0x000000000066F000-memory.dmpFilesize
2.4MB
-
memory/968-104-0x0000000000400000-0x000000000066F000-memory.dmpFilesize
2.4MB
-
memory/968-115-0x00000000004014B0-mapping.dmp
-
memory/968-118-0x0000000000400000-0x000000000066F000-memory.dmpFilesize
2.4MB
-
memory/1120-67-0x0000000000000000-mapping.dmp
-
memory/1172-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmpFilesize
8KB
-
memory/1492-68-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/1492-66-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/1492-64-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/1492-63-0x000000000042318F-mapping.dmp
-
memory/1492-57-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/1492-55-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB