Analysis
- max time kernel
150s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
24/01/2023, 17:51
General
- Target file.exe
- Size 176KB
- Sample230124-we5smsch84
- SHA256 bc920b349c0edabf7b151dc527d3d4a31aabc2a24fb8265ead0b36f2695ef88f
Malware Config
Extracted
-
vidar
-
2.2
-
237
-
https://t.me/litlebey
-
https://steamcommunity.com/profiles/76561199472399815
-
profile_id
237
Signatures
- Detects Smokeloader packer 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Executes dropped EXE 3 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F71.exeC:\Users\Admin\AppData\Local\Temp\F71.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 10322⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\10F9.exeC:\Users\Admin\AppData\Local\Temp\10F9.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 18002⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1536 -ip 15361⤵
-
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exeC:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
10F9.exe
10F9.exe
F71.exe
F71.exe
svcupdater.exe
svcupdater.exe
memory/208-182-0x0000000000400000-0x000000000046D000-memory.dmp
memory/208-153-0x000000000064D000-0x0000000000677000-memory.dmp
memory/208-181-0x000000000064D000-0x0000000000677000-memory.dmp
memory/208-155-0x0000000000400000-0x000000000046D000-memory.dmp
memory/208-154-0x00000000005C0000-0x0000000000607000-memory.dmp
memory/956-132-0x0000000002F0D000-0x0000000002F20000-memory.dmp
memory/956-135-0x0000000000400000-0x0000000002B96000-memory.dmp
memory/956-134-0x0000000000400000-0x0000000002B96000-memory.dmp
memory/956-133-0x0000000002E30000-0x0000000002E39000-memory.dmp
memory/1252-189-0x000000000076C000-0x0000000000796000-memory.dmp
memory/1252-188-0x0000000000400000-0x000000000046D000-memory.dmp
memory/1252-187-0x000000000076C000-0x0000000000796000-memory.dmp
memory/1536-143-0x0000000000700000-0x0000000000B89000-memory.dmp
memory/1536-149-0x0000000000700000-0x0000000000B89000-memory.dmp
memory/1536-151-0x0000000000700000-0x0000000000B89000-memory.dmp
memory/1536-156-0x0000000000700000-0x0000000000B89000-memory.dmp
memory/1536-157-0x00000000771B0000-0x0000000077353000-memory.dmp
memory/1536-158-0x0000000060900000-0x0000000060992000-memory.dmp
memory/1536-177-0x0000000000700000-0x0000000000B89000-memory.dmp
memory/1536-150-0x0000000000700000-0x0000000000B89000-memory.dmp
memory/1536-152-0x0000000000700000-0x0000000000B89000-memory.dmp
memory/1536-148-0x0000000000700000-0x0000000000B89000-memory.dmp
memory/1536-147-0x0000000000700000-0x0000000000B89000-memory.dmp
memory/1536-183-0x0000000000700000-0x0000000000B89000-memory.dmp
memory/1536-184-0x00000000771B0000-0x0000000077353000-memory.dmp
memory/1536-146-0x0000000000700000-0x0000000000B89000-memory.dmp
memory/1536-145-0x00000000771B0000-0x0000000077353000-memory.dmp
memory/1536-144-0x0000000000700000-0x0000000000B89000-memory.dmp
memory/1536-142-0x0000000000700000-0x0000000000B89000-memory.dmp