Analysis
-
max time kernel
71s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2023 11:13
Static task
static1
Behavioral task
behavioral1
Sample
67d623696828f77a0c7b9c81960709579c7b95f4c26d569b420ab05bbdf0049d.exe
Resource
win7-20220901-en
5 signatures
150 seconds
General
-
Target
67d623696828f77a0c7b9c81960709579c7b95f4c26d569b420ab05bbdf0049d.exe
-
Size
528KB
-
MD5
9105e24109392b36a6551e7fcd752973
-
SHA1
56bc844aa457de6b450cf08c427d534e7331572f
-
SHA256
67d623696828f77a0c7b9c81960709579c7b95f4c26d569b420ab05bbdf0049d
-
SHA512
cd1682f425b1529d2ac95ace0f2bc13dc89e828f28d4c2b4d0599332c8c25648e3d700156a68cc197e222fc4d717b713826f4a36d1346bbf6c2d35e188c8890f
-
SSDEEP
12288:0TvwH50cBHpdEfEOYeGB5L+8wpMTB6xW1ZJ8/FcHxSn:ZyIHy8eGfL+zwfG/FwO
Malware Config
Extracted
Family
vidar
Version
1.9
Botnet
821
C2
https://t.me/travelticketshop
https://steamcommunity.com/profiles/76561199469016299
Attributes
-
profile_id
821
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
67d623696828f77a0c7b9c81960709579c7b95f4c26d569b420ab05bbdf0049d.exedescription pid process target process PID 5088 set thread context of 1184 5088 67d623696828f77a0c7b9c81960709579c7b95f4c26d569b420ab05bbdf0049d.exe vbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1136 5088 WerFault.exe 67d623696828f77a0c7b9c81960709579c7b95f4c26d569b420ab05bbdf0049d.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
67d623696828f77a0c7b9c81960709579c7b95f4c26d569b420ab05bbdf0049d.exedescription pid process target process PID 5088 wrote to memory of 1184 5088 67d623696828f77a0c7b9c81960709579c7b95f4c26d569b420ab05bbdf0049d.exe vbc.exe PID 5088 wrote to memory of 1184 5088 67d623696828f77a0c7b9c81960709579c7b95f4c26d569b420ab05bbdf0049d.exe vbc.exe PID 5088 wrote to memory of 1184 5088 67d623696828f77a0c7b9c81960709579c7b95f4c26d569b420ab05bbdf0049d.exe vbc.exe PID 5088 wrote to memory of 1184 5088 67d623696828f77a0c7b9c81960709579c7b95f4c26d569b420ab05bbdf0049d.exe vbc.exe PID 5088 wrote to memory of 1184 5088 67d623696828f77a0c7b9c81960709579c7b95f4c26d569b420ab05bbdf0049d.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\67d623696828f77a0c7b9c81960709579c7b95f4c26d569b420ab05bbdf0049d.exe"C:\Users\Admin\AppData\Local\Temp\67d623696828f77a0c7b9c81960709579c7b95f4c26d569b420ab05bbdf0049d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 2642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5088 -ip 50881⤵