Analysis
-
max time kernel
106s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27-01-2023 04:38
Static task
static1
Behavioral task
behavioral1
Sample
a53466fc1c01a7fa4ac637e46c8ca0cd.exe
Resource
win7-20221111-en
General
-
Target
a53466fc1c01a7fa4ac637e46c8ca0cd.exe
-
Size
596KB
-
MD5
a53466fc1c01a7fa4ac637e46c8ca0cd
-
SHA1
1fd22e354e8ca425a1de630bffb54e2d10435b62
-
SHA256
adb4d5bc0e359b762c9af262bcbaecd7effc14742631afdc650eb8b8feb54003
-
SHA512
756e67a0241671a1dd7b42f5c481be79fc5f07f7a24e22abc0629d575a6f34362d4ccd35a5f6d6d831830a60495b2f25e11b205d0adcb115c8b8131895af277d
-
SSDEEP
12288:PToPWBv/cpGrU3ywDwK7KvDJCbAvyDcdSCYZLYL6h:PTbBv5rUTwK78dChctYZLYL6h
Malware Config
Extracted
vidar
2.2
818
https://t.me/litlebey
https://steamcommunity.com/profiles/76561199472399815
-
profile_id
818
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2428-156-0x0000000000400000-0x0000000000422000-memory.dmp asyncrat behavioral2/memory/4652-162-0x0000000000DB0000-0x0000000000E26000-memory.dmp asyncrat -
Executes dropped EXE 3 IoCs
Processes:
scoresystem.exeWATCHT~2.EXE1717.exepid process 4088 scoresystem.exe 4544 WATCHT~2.EXE 4652 1717.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WATCHT~2.EXEa53466fc1c01a7fa4ac637e46c8ca0cd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation WATCHT~2.EXE Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation a53466fc1c01a7fa4ac637e46c8ca0cd.exe -
Loads dropped DLL 2 IoCs
Processes:
AppLaunch.exepid process 920 AppLaunch.exe 920 AppLaunch.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
scoresystem.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce scoresystem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" scoresystem.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
WATCHT~2.EXE1717.exedescription pid process target process PID 4544 set thread context of 920 4544 WATCHT~2.EXE AppLaunch.exe PID 4652 set thread context of 2428 4652 1717.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4752 4652 WerFault.exe 1717.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AppLaunch.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AppLaunch.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1972 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exeWATCHT~2.EXEAppLaunch.exepid process 1444 powershell.exe 1444 powershell.exe 4544 WATCHT~2.EXE 4544 WATCHT~2.EXE 920 AppLaunch.exe 920 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WATCHT~2.EXEpowershell.exevbc.exedescription pid process Token: SeDebugPrivilege 4544 WATCHT~2.EXE Token: SeDebugPrivilege 1444 powershell.exe Token: SeDebugPrivilege 2428 vbc.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
a53466fc1c01a7fa4ac637e46c8ca0cd.exescoresystem.exeWATCHT~2.EXE1717.exeAppLaunch.execmd.exedescription pid process target process PID 4888 wrote to memory of 4088 4888 a53466fc1c01a7fa4ac637e46c8ca0cd.exe scoresystem.exe PID 4888 wrote to memory of 4088 4888 a53466fc1c01a7fa4ac637e46c8ca0cd.exe scoresystem.exe PID 4088 wrote to memory of 4544 4088 scoresystem.exe WATCHT~2.EXE PID 4088 wrote to memory of 4544 4088 scoresystem.exe WATCHT~2.EXE PID 4088 wrote to memory of 4544 4088 scoresystem.exe WATCHT~2.EXE PID 4544 wrote to memory of 1444 4544 WATCHT~2.EXE powershell.exe PID 4544 wrote to memory of 1444 4544 WATCHT~2.EXE powershell.exe PID 4544 wrote to memory of 1444 4544 WATCHT~2.EXE powershell.exe PID 4544 wrote to memory of 812 4544 WATCHT~2.EXE AppLaunch.exe PID 4544 wrote to memory of 812 4544 WATCHT~2.EXE AppLaunch.exe PID 4544 wrote to memory of 812 4544 WATCHT~2.EXE AppLaunch.exe PID 4544 wrote to memory of 920 4544 WATCHT~2.EXE AppLaunch.exe PID 4544 wrote to memory of 920 4544 WATCHT~2.EXE AppLaunch.exe PID 4544 wrote to memory of 920 4544 WATCHT~2.EXE AppLaunch.exe PID 4544 wrote to memory of 920 4544 WATCHT~2.EXE AppLaunch.exe PID 4544 wrote to memory of 920 4544 WATCHT~2.EXE AppLaunch.exe PID 4544 wrote to memory of 920 4544 WATCHT~2.EXE AppLaunch.exe PID 4544 wrote to memory of 920 4544 WATCHT~2.EXE AppLaunch.exe PID 4544 wrote to memory of 920 4544 WATCHT~2.EXE AppLaunch.exe PID 4544 wrote to memory of 920 4544 WATCHT~2.EXE AppLaunch.exe PID 4888 wrote to memory of 4652 4888 a53466fc1c01a7fa4ac637e46c8ca0cd.exe 1717.exe PID 4888 wrote to memory of 4652 4888 a53466fc1c01a7fa4ac637e46c8ca0cd.exe 1717.exe PID 4888 wrote to memory of 4652 4888 a53466fc1c01a7fa4ac637e46c8ca0cd.exe 1717.exe PID 4652 wrote to memory of 2428 4652 1717.exe vbc.exe PID 4652 wrote to memory of 2428 4652 1717.exe vbc.exe PID 4652 wrote to memory of 2428 4652 1717.exe vbc.exe PID 4652 wrote to memory of 2428 4652 1717.exe vbc.exe PID 4652 wrote to memory of 2428 4652 1717.exe vbc.exe PID 920 wrote to memory of 4376 920 AppLaunch.exe cmd.exe PID 920 wrote to memory of 4376 920 AppLaunch.exe cmd.exe PID 920 wrote to memory of 4376 920 AppLaunch.exe cmd.exe PID 4376 wrote to memory of 1972 4376 cmd.exe timeout.exe PID 4376 wrote to memory of 1972 4376 cmd.exe timeout.exe PID 4376 wrote to memory of 1972 4376 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a53466fc1c01a7fa4ac637e46c8ca0cd.exe"C:\Users\Admin\AppData\Local\Temp\a53466fc1c01a7fa4ac637e46c8ca0cd.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\scoresystem.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\scoresystem.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WATCHT~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WATCHT~2.EXE3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe4⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 66⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\1717.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\1717.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 3043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4652 -ip 46521⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\mozglue.dllFilesize
133KB
MD58f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
C:\ProgramData\nss3.dllFilesize
1.2MB
MD5bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WATCHT~2.EXEFilesize
362.4MB
MD510155f7d28c09033e8064c23d8d753db
SHA142362a2d24e1e7bf7f97a2f5fb72a81306536bb6
SHA2562f78ba61101b4ae38e44d1e0edad8b195bc801b4cd91c4c8881d547c7073c655
SHA512a626aa9a6f605bdfcb5d0455e1db27022b16a368aaefc2b7842c7aa188221ad9efa78ea1a7d915c0513e6ac3db564d2777601f1c7921864cacd793be6b81bd41
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WATCHT~2.EXEFilesize
362.4MB
MD510155f7d28c09033e8064c23d8d753db
SHA142362a2d24e1e7bf7f97a2f5fb72a81306536bb6
SHA2562f78ba61101b4ae38e44d1e0edad8b195bc801b4cd91c4c8881d547c7073c655
SHA512a626aa9a6f605bdfcb5d0455e1db27022b16a368aaefc2b7842c7aa188221ad9efa78ea1a7d915c0513e6ac3db564d2777601f1c7921864cacd793be6b81bd41
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\1717.exeFilesize
457KB
MD566e815946cfe9ffe0027ebf4db30fda9
SHA1a0edd0ab8909ac842ec77573497fe7f40401beb8
SHA25621314404c10b04494713bd805fff8d42fc63513b5a4c434b4826a41c9b556c22
SHA51294335b7fb0c2952df4fbae0fa630f3ec5612783866d86d468f5b4429ba1c2617939ebeed7c54c8ebe2db9fa1f837e929974e646211ff8ce7e35c505c33679660
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\1717.exeFilesize
457KB
MD566e815946cfe9ffe0027ebf4db30fda9
SHA1a0edd0ab8909ac842ec77573497fe7f40401beb8
SHA25621314404c10b04494713bd805fff8d42fc63513b5a4c434b4826a41c9b556c22
SHA51294335b7fb0c2952df4fbae0fa630f3ec5612783866d86d468f5b4429ba1c2617939ebeed7c54c8ebe2db9fa1f837e929974e646211ff8ce7e35c505c33679660
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\scoresystem.exeFilesize
630KB
MD5de39a7b5729cecc97244042f6eb858f7
SHA1be4b03f12f9a81a2cbf6c782c66d230e609e0424
SHA256f2e08945074adcc47885bd4f848112b9605238d0cc00db1e686bc567b408e687
SHA512e01266297515b23e6f25cfd379c6c611f3ea94a58d239b0f3cd5254c4de503a2ee7ca0b150b14da6b7c81954c15025e57ce88bd796d1d150832f51a69b57c0f8
-
memory/812-147-0x0000000000000000-mapping.dmp
-
memory/920-164-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/920-148-0x0000000000000000-mapping.dmp
-
memory/920-189-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/920-150-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/920-167-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/920-151-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/920-149-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/1444-144-0x00000000068C0000-0x00000000068DE000-memory.dmpFilesize
120KB
-
memory/1444-140-0x0000000003280000-0x00000000032B6000-memory.dmpFilesize
216KB
-
memory/1444-146-0x0000000006DD0000-0x0000000006DEA000-memory.dmpFilesize
104KB
-
memory/1444-145-0x00000000080F0000-0x000000000876A000-memory.dmpFilesize
6.5MB
-
memory/1444-143-0x00000000061C0000-0x0000000006226000-memory.dmpFilesize
408KB
-
memory/1444-139-0x0000000000000000-mapping.dmp
-
memory/1444-142-0x0000000006050000-0x00000000060B6000-memory.dmpFilesize
408KB
-
memory/1444-141-0x0000000005920000-0x0000000005F48000-memory.dmpFilesize
6.2MB
-
memory/1972-190-0x0000000000000000-mapping.dmp
-
memory/2428-155-0x0000000000000000-mapping.dmp
-
memory/2428-161-0x0000000002E20000-0x0000000002E32000-memory.dmpFilesize
72KB
-
memory/2428-163-0x0000000005C20000-0x0000000005C5C000-memory.dmpFilesize
240KB
-
memory/2428-165-0x0000000006000000-0x000000000609C000-memory.dmpFilesize
624KB
-
memory/2428-166-0x0000000006650000-0x0000000006BF4000-memory.dmpFilesize
5.6MB
-
memory/2428-156-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/4088-132-0x0000000000000000-mapping.dmp
-
memory/4376-188-0x0000000000000000-mapping.dmp
-
memory/4544-137-0x0000000000DB0000-0x0000000000DBA000-memory.dmpFilesize
40KB
-
memory/4544-134-0x0000000000000000-mapping.dmp
-
memory/4544-138-0x0000000006590000-0x00000000065B2000-memory.dmpFilesize
136KB
-
memory/4652-162-0x0000000000DB0000-0x0000000000E26000-memory.dmpFilesize
472KB
-
memory/4652-152-0x0000000000000000-mapping.dmp