Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-01-2023 16:41

General

  • Target

    file.exe

  • Size

    176KB

  • MD5

    412910fbbe122dbc56496e41a8b72b54

  • SHA1

    8a5f50d644c56702b7edb16ee368a64bef7aea24

  • SHA256

    74b86eed28104c9f459d08d48044192745239f643d8896892acf46ce60deb3fc

  • SHA512

    6f69dc1e2c357eaf2f47258b30e84ee2d80579ad1ea145b2385995c6a257ec8ddf5efb3608e77724c16f9a9b936c46b205b0133a3e141b1b84c2f9e8072da66d

  • SSDEEP

    3072:ABN2XdPtLzQWbQ5p8F69mKG5DdWNNO/pOdj0V/E0PVPVGss:oYLMWbNPR+lE/3fG

Malware Config

Extracted

Family

vidar

Version

2.2

Botnet

237

C2

https://t.me/litlebey

https://steamcommunity.com/profiles/76561199472399815

Attributes
  • profile_id

    237

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3208
  • C:\Users\Admin\AppData\Local\Temp\CFB8.exe
    C:\Users\Admin\AppData\Local\Temp\CFB8.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3872
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
      2⤵
      • Creates scheduled task(s)
      PID:3992
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 1128
      2⤵
      • Program crash
      PID:4176
  • C:\Users\Admin\AppData\Local\Temp\D130.exe
    C:\Users\Admin\AppData\Local\Temp\D130.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks processor information in registry
    PID:2100
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 1540
      2⤵
      • Program crash
      PID:4644
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3872 -ip 3872
    1⤵
      PID:2608
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 2100 -ip 2100
      1⤵
        PID:820
      • C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
        C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
        1⤵
        • Executes dropped EXE
        PID:2268

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Virtualization/Sandbox Evasion

      1
      T1497

      Credential Access

      Credentials in Files

      3
      T1081

      Discovery

      Query Registry

      6
      T1012

      Virtualization/Sandbox Evasion

      1
      T1497

      System Information Discovery

      6
      T1082

      Peripheral Device Discovery

      1
      T1120

      Collection

      Data from Local System

      3
      T1005

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\mozglue.dll
        Filesize

        133KB

        MD5

        8f73c08a9660691143661bf7332c3c27

        SHA1

        37fa65dd737c50fda710fdbde89e51374d0c204a

        SHA256

        3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

        SHA512

        0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

      • C:\ProgramData\nss3.dll
        Filesize

        1.2MB

        MD5

        bfac4e3c5908856ba17d41edcd455a51

        SHA1

        8eec7e888767aa9e4cca8ff246eb2aacb9170428

        SHA256

        e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

        SHA512

        2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

      • C:\Users\Admin\AppData\Local\Temp\CFB8.exe
        Filesize

        408KB

        MD5

        261b1db94ccf4266128e2eb71a80fda4

        SHA1

        9d4cd03297f31eabe957f261dc7c3c6c268bd39f

        SHA256

        b0072463e78182e8d9721f91f889a62d9ce59a348fddc5196b6201a5fa68b259

        SHA512

        2dd25970561cf9e3d946acd891b601e6aa7e6563dde6c10ed5ac1a6486bbc1851cf3908b5bdee6c9b29633e51c90339209c50d97c0ea28b897bd6e7117b1ac7b

      • C:\Users\Admin\AppData\Local\Temp\CFB8.exe
        Filesize

        408KB

        MD5

        261b1db94ccf4266128e2eb71a80fda4

        SHA1

        9d4cd03297f31eabe957f261dc7c3c6c268bd39f

        SHA256

        b0072463e78182e8d9721f91f889a62d9ce59a348fddc5196b6201a5fa68b259

        SHA512

        2dd25970561cf9e3d946acd891b601e6aa7e6563dde6c10ed5ac1a6486bbc1851cf3908b5bdee6c9b29633e51c90339209c50d97c0ea28b897bd6e7117b1ac7b

      • C:\Users\Admin\AppData\Local\Temp\D130.exe
        Filesize

        1.6MB

        MD5

        9a7432c6e41b43262f87e70b15bfd706

        SHA1

        3f8664fcea0a2857d9b98e14dfef588b0d8a6a78

        SHA256

        66a4157601cecc7190f76be440e5684ed02bfbb62fd4fb3f6053ca60fdc1b0c5

        SHA512

        e4b496383837ae37629b4ef7b277f3e98af6b93826c7949b2ae92c856953e53102d661de9f22b012f8f80ae853d6712c63d779f12e5eeb29a85001018b884018

      • C:\Users\Admin\AppData\Local\Temp\D130.exe
        Filesize

        1.6MB

        MD5

        9a7432c6e41b43262f87e70b15bfd706

        SHA1

        3f8664fcea0a2857d9b98e14dfef588b0d8a6a78

        SHA256

        66a4157601cecc7190f76be440e5684ed02bfbb62fd4fb3f6053ca60fdc1b0c5

        SHA512

        e4b496383837ae37629b4ef7b277f3e98af6b93826c7949b2ae92c856953e53102d661de9f22b012f8f80ae853d6712c63d779f12e5eeb29a85001018b884018

      • C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
        Filesize

        748.7MB

        MD5

        34e07c0fb27ddaf49c3f41d836bd653e

        SHA1

        6eb82df3c1a47c9b1034ae7818a2df9c234e5843

        SHA256

        4bb24d7dfd498f341ba32b19730115973ca36afb1db02840fb6c0bf95959dbcc

        SHA512

        3d0abd02559411ebeb94937056ae142e17ca1b58f93475a228dddc5f9ac4330711920937cd2aaf2d0874a19019079d656721a3f821420351a1a527e14cbccbc9

      • C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
        Filesize

        750.4MB

        MD5

        6a2afdb050476d369d8b7ac5223cb6b5

        SHA1

        66faba8d8cdd38c9bb7f66cc1269fe81a288c079

        SHA256

        29d043549914739c66e81256054813ab426e8ceb42b3963cfaa3ad4b1ca4469d

        SHA512

        692ddc22607340796b74547cdd48ec1699e692650043c6a381d25959497d593fb1b2761a0abb54b86fcb20b5a16bb6aa17082b71c66e713d2d5b21b0e45a0053

      • memory/2100-142-0x0000000000160000-0x00000000005E9000-memory.dmp
        Filesize

        4.5MB

      • memory/2100-156-0x0000000000160000-0x00000000005E9000-memory.dmp
        Filesize

        4.5MB

      • memory/2100-160-0x0000000060900000-0x0000000060992000-memory.dmp
        Filesize

        584KB

      • memory/2100-143-0x0000000000160000-0x00000000005E9000-memory.dmp
        Filesize

        4.5MB

      • memory/2100-181-0x00000000772E0000-0x0000000077483000-memory.dmp
        Filesize

        1.6MB

      • memory/2100-144-0x0000000000160000-0x00000000005E9000-memory.dmp
        Filesize

        4.5MB

      • memory/2100-182-0x0000000000160000-0x00000000005E9000-memory.dmp
        Filesize

        4.5MB

      • memory/2100-147-0x0000000000160000-0x00000000005E9000-memory.dmp
        Filesize

        4.5MB

      • memory/2100-184-0x00000000772E0000-0x0000000077483000-memory.dmp
        Filesize

        1.6MB

      • memory/2100-149-0x00000000772E0000-0x0000000077483000-memory.dmp
        Filesize

        1.6MB

      • memory/2100-150-0x0000000000160000-0x00000000005E9000-memory.dmp
        Filesize

        4.5MB

      • memory/2100-151-0x0000000000160000-0x00000000005E9000-memory.dmp
        Filesize

        4.5MB

      • memory/2100-152-0x0000000000160000-0x00000000005E9000-memory.dmp
        Filesize

        4.5MB

      • memory/2100-153-0x0000000000160000-0x00000000005E9000-memory.dmp
        Filesize

        4.5MB

      • memory/2100-154-0x0000000000160000-0x00000000005E9000-memory.dmp
        Filesize

        4.5MB

      • memory/2100-155-0x0000000000160000-0x00000000005E9000-memory.dmp
        Filesize

        4.5MB

      • memory/2100-139-0x0000000000000000-mapping.dmp
      • memory/2100-183-0x0000000000160000-0x00000000005E9000-memory.dmp
        Filesize

        4.5MB

      • memory/2268-187-0x00000000005BC000-0x00000000005E6000-memory.dmp
        Filesize

        168KB

      • memory/2268-188-0x0000000000400000-0x000000000046D000-memory.dmp
        Filesize

        436KB

      • memory/2268-189-0x00000000005BC000-0x00000000005E6000-memory.dmp
        Filesize

        168KB

      • memory/3208-135-0x0000000000400000-0x0000000002B96000-memory.dmp
        Filesize

        39.6MB

      • memory/3208-134-0x0000000000400000-0x0000000002B96000-memory.dmp
        Filesize

        39.6MB

      • memory/3208-133-0x0000000002C60000-0x0000000002C69000-memory.dmp
        Filesize

        36KB

      • memory/3208-132-0x0000000002C9D000-0x0000000002CB0000-memory.dmp
        Filesize

        76KB

      • memory/3872-136-0x0000000000000000-mapping.dmp
      • memory/3872-159-0x0000000000400000-0x000000000046D000-memory.dmp
        Filesize

        436KB

      • memory/3872-158-0x000000000061D000-0x0000000000647000-memory.dmp
        Filesize

        168KB

      • memory/3872-148-0x0000000000400000-0x000000000046D000-memory.dmp
        Filesize

        436KB

      • memory/3872-146-0x00000000020A0000-0x00000000020E7000-memory.dmp
        Filesize

        284KB

      • memory/3872-145-0x000000000061D000-0x0000000000647000-memory.dmp
        Filesize

        168KB

      • memory/3992-157-0x0000000000000000-mapping.dmp