vidar | 4a09459d095915e4ea732d5fd9aa453e0a05603baa711696bcc9c9f479cbcecf

Analysis

max time kernel
99s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2023 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

470.6MB
MD5

5909ae2b1c956d4c13b1e6041fdb7f9d
SHA1

8e500369fda8625e0c153c07aabc3ca383d49d44
SHA256

b4b353183fc52980c539601936d8a3774e78f4f8d44e64e8e7082427eed06dbf
SHA512

de385015cb140cbeed61dfd6f923a1b8db054e5cb062e6ca8be0a94de9bccbe3ef3cb1e9fcceb14a0aa64f327e35efc449c47e7d15cb9e358ef8bc80ba2411d2
SSDEEP

49152:FDHrATS9GPSiK6Wl6n+XXZEk4fvXAFXr4ND9pv/OSt5GjhCbhontKH5ck6JjH:FDHoPnWoUSXhjpv//t0jhC+ntkOn

Score

10^/10

vidar 15 discovery evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

vidar

Version

2.2

Botnet

https://t.me/litlebey

https://steamcommunity.com/profiles/76561199472399815

Attributes

profile_id
15

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

Setup.exe95453714289993026678.exeWlndowsDraiver-Ver9.5.9.0.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	95453714289993026678.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	WlndowsDraiver-Ver9.5.9.0.exe

Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

95453714289993026678.exe55281894466795683219.exeWlndowsDraiver-Ver9.5.9.0.exe

pid process

3404 95453714289993026678.exe
5112 55281894466795683219.exe
1136 WlndowsDraiver-Ver9.5.9.0.exe

pid	process
3404	95453714289993026678.exe
5112	55281894466795683219.exe
1136	WlndowsDraiver-Ver9.5.9.0.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exe95453714289993026678.exeWlndowsDraiver-Ver9.5.9.0.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	95453714289993026678.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	95453714289993026678.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WlndowsDraiver-Ver9.5.9.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WlndowsDraiver-Ver9.5.9.0.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

95453714289993026678.exeSetup.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	95453714289993026678.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Setup.exe

Loads dropped DLL 2 IoCs

Processes:

Setup.exe

pid process

528 Setup.exe
528 Setup.exe
Modifies file permissions 1 TTPs 3 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exe

pid process

3596 icacls.exe
1996 icacls.exe
1552 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3596	icacls.exe
1996	icacls.exe
1552	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

95453714289993026678.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	95453714289993026678.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9XO9IOFU = "C:\\ProgramData\\O8OOISS9\\WlndowsDraiver-Ver9.5.9.0.exe"	95453714289993026678.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Setup.exe95453714289993026678.exeWlndowsDraiver-Ver9.5.9.0.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	95453714289993026678.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WlndowsDraiver-Ver9.5.9.0.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Setup.exe

pid process

528 Setup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Setup.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3044 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4736 timeout.exe

pid	process
3044	schtasks.exe

pid	process
4736	timeout.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

55281894466795683219.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	55281894466795683219.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	55281894466795683219.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	55281894466795683219.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Setup.exe95453714289993026678.exe

pid	process
528	Setup.exe
528	Setup.exe
528	Setup.exe
528	Setup.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe
3404	95453714289993026678.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

Setup.exe55281894466795683219.execmd.execmd.exe95453714289993026678.exe

description	pid	process	target process
PID 528 wrote to memory of 3404	528	Setup.exe	95453714289993026678.exe
PID 528 wrote to memory of 3404	528	Setup.exe	95453714289993026678.exe
PID 528 wrote to memory of 5112	528	Setup.exe	55281894466795683219.exe
PID 528 wrote to memory of 5112	528	Setup.exe	55281894466795683219.exe
PID 5112 wrote to memory of 3376	5112	55281894466795683219.exe	cmd.exe
PID 5112 wrote to memory of 3376	5112	55281894466795683219.exe	cmd.exe
PID 528 wrote to memory of 424	528	Setup.exe	cmd.exe
PID 528 wrote to memory of 424	528	Setup.exe	cmd.exe
PID 528 wrote to memory of 424	528	Setup.exe	cmd.exe
PID 3376 wrote to memory of 4500	3376	cmd.exe	choice.exe
PID 3376 wrote to memory of 4500	3376	cmd.exe	choice.exe
PID 424 wrote to memory of 4736	424	cmd.exe	timeout.exe
PID 424 wrote to memory of 4736	424	cmd.exe	timeout.exe
PID 424 wrote to memory of 4736	424	cmd.exe	timeout.exe
PID 3404 wrote to memory of 3044	3404	95453714289993026678.exe	schtasks.exe
PID 3404 wrote to memory of 3044	3404	95453714289993026678.exe	schtasks.exe
PID 3404 wrote to memory of 3596	3404	95453714289993026678.exe	icacls.exe
PID 3404 wrote to memory of 3596	3404	95453714289993026678.exe	icacls.exe
PID 3404 wrote to memory of 1996	3404	95453714289993026678.exe	icacls.exe
PID 3404 wrote to memory of 1996	3404	95453714289993026678.exe	icacls.exe
PID 3404 wrote to memory of 1552	3404	95453714289993026678.exe	icacls.exe
PID 3404 wrote to memory of 1552	3404	95453714289993026678.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:528

C:\ProgramData\95453714289993026678.exe
"C:\ProgramData\95453714289993026678.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3404

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /CREATE /TN "9.5.9.Microsoft.NET\AgentActivationRuntime9.5.9.\IntelPalnt9.5.9." /TR "C:\ProgramData\O8OOISS9\WlndowsDraiver-Ver9.5.9.0.exe" /SC MINUTE
3⤵
- Creates scheduled task(s)
PID:3044

C:\Windows\System32\icacls.exe
"C:\Windows\System32\icacls.exe" "C:\ProgramData\O8OOISS9" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:3596

C:\Windows\System32\icacls.exe
"C:\Windows\System32\icacls.exe" "C:\ProgramData\O8OOISS9" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:1996

C:\Windows\System32\icacls.exe
"C:\Windows\System32\icacls.exe" "C:\ProgramData\O8OOISS9" /inheritance:e /deny "admin:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:1552

C:\ProgramData\55281894466795683219.exe
"C:\ProgramData\55281894466795683219.exe"
2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\55281894466795683219.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3376

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 0
4⤵
PID:4500

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Setup.exe" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:424

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
3⤵
- Delays execution with timeout.exe
PID:4736

C:\ProgramData\O8OOISS9\WlndowsDraiver-Ver9.5.9.0.exe
C:\ProgramData\O8OOISS9\WlndowsDraiver-Ver9.5.9.0.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:1136

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

File Permissions Modification

T1222

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\55281894466795683219.exe
Filesize
7.4MB

MD5
7c3c33a79f460a4536433f5ba99b3fcd

SHA1
2a3d9abc1a733453804213b8bf24f14bfa5cd581

SHA256
88dbf134cd4628fc8b97cc1adf5201cae875df1fa5280b3cbc0306478161e9f4

SHA512
0e4330014b00e1eb3318692862574f7142ce97be02ebd3c00932aec99e236196652f7f7ea95aef7cf3b2501c0c167ce17772bafdebe998a638678e990c7368c4

Download Submit
C:\ProgramData\55281894466795683219.exe
Filesize
7.4MB

MD5
7c3c33a79f460a4536433f5ba99b3fcd

SHA1
2a3d9abc1a733453804213b8bf24f14bfa5cd581

SHA256
88dbf134cd4628fc8b97cc1adf5201cae875df1fa5280b3cbc0306478161e9f4

SHA512
0e4330014b00e1eb3318692862574f7142ce97be02ebd3c00932aec99e236196652f7f7ea95aef7cf3b2501c0c167ce17772bafdebe998a638678e990c7368c4

Download Submit
C:\ProgramData\95453714289993026678.exe
Filesize
9.9MB

MD5
2656417019396085e92957933d6d5418

SHA1
f2395b39a403f89df2f161ed813b1015729c2308

SHA256
00a1be7e46454a3604aed2b824952e35d49330f2ebc28b9b03c03f0ffd71af89

SHA512
7ce74e33879b21863638836a9c67ff995a53bbdbe02e0db452661aa48fccfd4b20cf1cea5a071f0a815745e2eea90756e8465a5db5c4dfe388fdfcb4b0bcd1d5

Download Submit
C:\ProgramData\95453714289993026678.exe
Filesize
9.9MB

MD5
2656417019396085e92957933d6d5418

SHA1
f2395b39a403f89df2f161ed813b1015729c2308

SHA256
00a1be7e46454a3604aed2b824952e35d49330f2ebc28b9b03c03f0ffd71af89

SHA512
7ce74e33879b21863638836a9c67ff995a53bbdbe02e0db452661aa48fccfd4b20cf1cea5a071f0a815745e2eea90756e8465a5db5c4dfe388fdfcb4b0bcd1d5

Download Submit
C:\ProgramData\O8OOISS9\WlndowsDraiver-Ver9.5.9.0.exe
Filesize
651.6MB

MD5
cdaf4235fef983d922fa592a701e4da2

SHA1
b1de1c0383f434db480d8c2ebf7093f4ff626d29

SHA256
fb9d878bc80e0f1ef76e2ac27a1f9bcd63e3e0a277e0ac2a34a4b92dc0f95c34

SHA512
a2ab554e9cd4e97774f43fc75951bcd4aa3839fb8a8b07d6a7480b60dd7f1d079ffa18e0f4929c0284d5855fceee21d8e248b7f7c7ecb39419969521fe3017ae

Download Submit
C:\ProgramData\O8OOISS9\WlndowsDraiver-Ver9.5.9.0.exe
Filesize
651.6MB

MD5
cdaf4235fef983d922fa592a701e4da2

SHA1
b1de1c0383f434db480d8c2ebf7093f4ff626d29

SHA256
fb9d878bc80e0f1ef76e2ac27a1f9bcd63e3e0a277e0ac2a34a4b92dc0f95c34

SHA512
a2ab554e9cd4e97774f43fc75951bcd4aa3839fb8a8b07d6a7480b60dd7f1d079ffa18e0f4929c0284d5855fceee21d8e248b7f7c7ecb39419969521fe3017ae

Download Submit
C:\ProgramData\mozglue.dll
Filesize
133KB

MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
C:\ProgramData\nss3.dll
Filesize
1.2MB

MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
memory/424-172-0x0000000000000000-mapping.dmp

Download
memory/528-161-0x0000000000400000-0x0000000000B79000-memory.dmp

Filesize
7.5MB

Download
memory/528-135-0x0000000000400000-0x0000000000B79000-memory.dmp

Filesize
7.5MB

Download
memory/528-132-0x0000000000400000-0x0000000000B79000-memory.dmp

Filesize
7.5MB

Download
memory/528-162-0x0000000077E30000-0x0000000077FD3000-memory.dmp

Filesize
1.6MB

Download
memory/528-163-0x0000000000400000-0x0000000000B79000-memory.dmp

Filesize
7.5MB

Download
memory/528-134-0x0000000000400000-0x0000000000B79000-memory.dmp

Filesize
7.5MB

Download
memory/528-139-0x0000000000400000-0x0000000000B79000-memory.dmp

Filesize
7.5MB

Download
memory/528-138-0x0000000077E30000-0x0000000077FD3000-memory.dmp

Filesize
1.6MB

Download
memory/528-133-0x0000000000400000-0x0000000000B79000-memory.dmp

Filesize
7.5MB

Download
memory/528-137-0x0000000000400000-0x0000000000B79000-memory.dmp

Filesize
7.5MB

Download
memory/528-136-0x0000000000400000-0x0000000000B79000-memory.dmp

Filesize
7.5MB

Download
memory/528-174-0x0000000077E30000-0x0000000077FD3000-memory.dmp

Filesize
1.6MB

Download
memory/528-173-0x0000000000400000-0x0000000000B79000-memory.dmp

Filesize
7.5MB

Download
memory/528-140-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/1136-197-0x00007FF74D7D0000-0x00007FF74EDAE000-memory.dmp

Filesize
21.9MB

Download
memory/1136-198-0x00007FF74D7D0000-0x00007FF74EDAE000-memory.dmp

Filesize
21.9MB

Download
memory/1136-193-0x00007FF74D7D0000-0x00007FF74EDAE000-memory.dmp

Filesize
21.9MB

Download
memory/1136-191-0x00007FF74D7D0000-0x00007FF74EDAE000-memory.dmp

Filesize
21.9MB

Download
memory/1136-199-0x00007FF74D7D0000-0x00007FF74EDAE000-memory.dmp

Filesize
21.9MB

Download
memory/1136-200-0x00007FF74D7D0000-0x00007FF74EDAE000-memory.dmp

Filesize
21.9MB

Download
memory/1552-187-0x0000000000000000-mapping.dmp

Download
memory/1996-186-0x0000000000000000-mapping.dmp

Download
memory/3044-184-0x0000000000000000-mapping.dmp

Download
memory/3376-171-0x0000000000000000-mapping.dmp

Download
memory/3404-189-0x00007FF78FAC0000-0x00007FF79109E000-memory.dmp

Filesize
21.9MB

Download
memory/3404-182-0x00007FF78FAC0000-0x00007FF79109E000-memory.dmp

Filesize
21.9MB

Download
memory/3404-181-0x00007FF78FAC0000-0x00007FF79109E000-memory.dmp

Filesize
21.9MB

Download
memory/3404-183-0x00007FF78FAC0000-0x00007FF79109E000-memory.dmp

Filesize
21.9MB

Download
memory/3404-177-0x00007FF78FAC0000-0x00007FF79109E000-memory.dmp

Filesize
21.9MB

Download
memory/3404-192-0x00007FF78FAC0000-0x00007FF79109E000-memory.dmp

Filesize
21.9MB

Download
memory/3404-170-0x00007FF78FAC0000-0x00007FF79109E000-memory.dmp

Filesize
21.9MB

Download
memory/3404-164-0x0000000000000000-mapping.dmp

Download
memory/3596-185-0x0000000000000000-mapping.dmp

Download
memory/4500-175-0x0000000000000000-mapping.dmp

Download
memory/4736-176-0x0000000000000000-mapping.dmp

Download
memory/5112-167-0x0000000000000000-mapping.dmp

Download