Analysis
- max time kernel
144s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
27/01/2023, 06:11
General
- Target 6E47A310F6E5D8032F5A6BEB227009BE5BFA3C878B264.exe
- Size 348KB
- Sample230127-gxk4mage82
- SHA256 6e47a310f6e5d8032f5a6beb227009be5bfa3c878b2642b6f6bf975c6adfda8a
Malware Config
Extracted
-
vidar
-
1.5
-
14
-
https://t.me/dahuasecurit
-
https://steamcommunity.com/profiles/76561199441999914
-
profile_id
14
Signatures
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 17 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6E47A310F6E5D8032F5A6BEB227009BE5BFA3C878B264.exe"C:\Users\Admin\AppData\Local\Temp\6E47A310F6E5D8032F5A6BEB227009BE5BFA3C878B264.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\84299186371871633546.exe"C:\ProgramData\84299186371871633546.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\6E47A310F6E5D8032F5A6BEB227009BE5BFA3C878B264.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 20922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4872 -ip 48721⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
84299186371871633546.exe
84299186371871633546.exe
mozglue.dll
nss3.dll
ntlhost.exe
ntlhost.exe
memory/224-166-0x0000000000380000-0x0000000000C15000-memory.dmp
memory/224-164-0x00007FFB9E910000-0x00007FFB9EB05000-memory.dmp
memory/224-175-0x00007FFB9E910000-0x00007FFB9EB05000-memory.dmp
memory/224-174-0x0000000000380000-0x0000000000C15000-memory.dmp
memory/224-168-0x0000000000380000-0x0000000000C15000-memory.dmp
memory/224-167-0x0000000000380000-0x0000000000C15000-memory.dmp
memory/224-163-0x0000000000380000-0x0000000000C15000-memory.dmp
memory/224-165-0x0000000000380000-0x0000000000C15000-memory.dmp
memory/2276-177-0x0000000000590000-0x0000000000E25000-memory.dmp
memory/2276-184-0x0000000000590000-0x0000000000E25000-memory.dmp
memory/2276-183-0x00007FFB9E910000-0x00007FFB9EB05000-memory.dmp
memory/2276-182-0x0000000000590000-0x0000000000E25000-memory.dmp
memory/2276-181-0x0000000000590000-0x0000000000E25000-memory.dmp
memory/2276-180-0x0000000000590000-0x0000000000E25000-memory.dmp
memory/2276-179-0x0000000000590000-0x0000000000E25000-memory.dmp
memory/2276-178-0x0000000000590000-0x0000000000E25000-memory.dmp
memory/2276-176-0x00007FFB9E910000-0x00007FFB9EB05000-memory.dmp
memory/4872-170-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4872-136-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4872-135-0x0000000000598000-0x00000000005C9000-memory.dmp
memory/4872-133-0x00000000021E0000-0x0000000002237000-memory.dmp
memory/4872-134-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4872-137-0x0000000060900000-0x0000000060992000-memory.dmp
memory/4872-132-0x0000000000598000-0x00000000005C9000-memory.dmp
memory/4872-169-0x0000000000598000-0x00000000005C9000-memory.dmp