vidar | 04fc208575dbe86f6239f612c8eddb0d9587b9c5a2e20ba5e96190f28ea61ce4

Analysis

max time kernel
95s
max time network
91s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
14/02/2023, 20:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.rar
Size

1.8MB
MD5

20db25a9fea3c1be7c05243f4a785f47
SHA1

93c957661c6fa16cf3444baf2ce5ded53e46feee
SHA256

04fc208575dbe86f6239f612c8eddb0d9587b9c5a2e20ba5e96190f28ea61ce4
SHA512

5e427fb5d5ccc6e38c00d0f6973b12b1075b319306a3beca394a93b792f08fcb9552923478265cdf68acb412eb80e8bc20f4764a577837aaf4ebd15bd9bd6ec9
SSDEEP

49152:SWDAhMeJFuQzcRKrAXNWNCLByJNg8CzPFQrWMlMbKZVl9V:SWDAhM6FEKrA9iCLByJJgFkiYl9V

Score

10^/10

vidar 408 spyware stealer

Malware Config

Extracted

Family

vidar

Version

2.5

Botnet

408

Attributes

profile_id
408

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1004	Loader.exe
1456	14499147407041265421.exe

Loads dropped DLL 4 IoCs

pid	Process
1676	AppLaunch.exe
1676	AppLaunch.exe
1676	AppLaunch.exe
1676	AppLaunch.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1004 set thread context of 1676	1004	Loader.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AppLaunch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AppLaunch.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1708	timeout.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\rar_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c003100000000006b55327e1000372d5a697000380008000400efbe6b55327e6b55327e2a0000000603010000000200000000000000000000000000000037002d005a0069007000000014000000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Applications\7zFM.exe\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\rar_auto_file\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\rar_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.rar\ = "rar_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.rar	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 88003100000000006b558882110050524f4752417e310000700008000400efbeee3a851a6b5588822a0000003c000000000001000000000000000000460000000000500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Applications\7zFM.exe	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\rar_auto_file\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\rar_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Applications\7zFM.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Applications\7zFM.exe\shell\open	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\rar_auto_file\shell\open	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Applications\7zFM.exe\shell\open\command	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1676	AppLaunch.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
920	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	920	7zFM.exe
Token: 35	920	7zFM.exe
Token: SeSecurityPrivilege	920	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
920	7zFM.exe
920	7zFM.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1588	rundll32.exe
1588	rundll32.exe
1588	rundll32.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 1588	624	cmd.exe	29
PID 624 wrote to memory of 1588	624	cmd.exe	29
PID 624 wrote to memory of 1588	624	cmd.exe	29
PID 1588 wrote to memory of 920	1588	rundll32.exe	30
PID 1588 wrote to memory of 920	1588	rundll32.exe	30
PID 1588 wrote to memory of 920	1588	rundll32.exe	30
PID 1004 wrote to memory of 1676	1004	Loader.exe	35
PID 1004 wrote to memory of 1676	1004	Loader.exe	35
PID 1004 wrote to memory of 1676	1004	Loader.exe	35
PID 1004 wrote to memory of 1676	1004	Loader.exe	35
PID 1004 wrote to memory of 1676	1004	Loader.exe	35
PID 1004 wrote to memory of 1676	1004	Loader.exe	35
PID 1004 wrote to memory of 1676	1004	Loader.exe	35
PID 1004 wrote to memory of 1676	1004	Loader.exe	35
PID 1004 wrote to memory of 1676	1004	Loader.exe	35
PID 1676 wrote to memory of 1456	1676	AppLaunch.exe	39
PID 1676 wrote to memory of 1456	1676	AppLaunch.exe	39
PID 1676 wrote to memory of 1456	1676	AppLaunch.exe	39
PID 1676 wrote to memory of 1456	1676	AppLaunch.exe	39
PID 1456 wrote to memory of 688	1456	14499147407041265421.exe	40
PID 1456 wrote to memory of 688	1456	14499147407041265421.exe	40
PID 1456 wrote to memory of 688	1456	14499147407041265421.exe	40
PID 688 wrote to memory of 2000	688	cmd.exe	42
PID 688 wrote to memory of 2000	688	cmd.exe	42
PID 688 wrote to memory of 2000	688	cmd.exe	42
PID 1676 wrote to memory of 1004	1676	AppLaunch.exe	43
PID 1676 wrote to memory of 1004	1676	AppLaunch.exe	43
PID 1676 wrote to memory of 1004	1676	AppLaunch.exe	43
PID 1676 wrote to memory of 1004	1676	AppLaunch.exe	43
PID 1676 wrote to memory of 1004	1676	AppLaunch.exe	43
PID 1676 wrote to memory of 1004	1676	AppLaunch.exe	43
PID 1676 wrote to memory of 1004	1676	AppLaunch.exe	43
PID 1004 wrote to memory of 1708	1004	cmd.exe	45
PID 1004 wrote to memory of 1708	1004	cmd.exe	45
PID 1004 wrote to memory of 1708	1004	cmd.exe	45
PID 1004 wrote to memory of 1708	1004	cmd.exe	45
PID 1004 wrote to memory of 1708	1004	cmd.exe	45
PID 1004 wrote to memory of 1708	1004	cmd.exe	45
PID 1004 wrote to memory of 1708	1004	cmd.exe	45

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Loader.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Loader.rar
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Loader.rar"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:920

C:\Users\Admin\Desktop\Loader.exe
"C:\Users\Admin\Desktop\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\ProgramData\14499147407041265421.exe
    "C:\ProgramData\14499147407041265421.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\14499147407041265421.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:688
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 0
        5⤵
        
        PID:2000
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\14499147407041265421.exe

Filesize
7.4MB

MD5
196b4e0f90bdd2c119b7ef9e3a1efa97

SHA1
955bcb5e2bf7f518bc56b8a2e1822498f08110cd

SHA256
5caf93ba3ebc06d7df2e84e9d00f488961850d3d014caa08401a4ab4cb0d75e6

SHA512
76f6292c1ad3bb21c0245be7985580f07587deac287ad91aa484603686b3336160ef0c7926c01860d8821865d20c02801e446d48407a58a182ed94e743ba6002

Download Submit
C:\ProgramData\14499147407041265421.exe

Filesize
7.4MB

MD5
196b4e0f90bdd2c119b7ef9e3a1efa97

SHA1
955bcb5e2bf7f518bc56b8a2e1822498f08110cd

SHA256
5caf93ba3ebc06d7df2e84e9d00f488961850d3d014caa08401a4ab4cb0d75e6

SHA512
76f6292c1ad3bb21c0245be7985580f07587deac287ad91aa484603686b3336160ef0c7926c01860d8821865d20c02801e446d48407a58a182ed94e743ba6002

Download Submit
C:\Users\Admin\Desktop\Loader.exe

Filesize
761.7MB

MD5
9550d7234c53606481695ef8ec353ac8

SHA1
a0834eebd07f1da43103799deec7b2de1424eceb

SHA256
de9da77d2e981116845e59d6040d10ab3c750d6789651ad845dd7521c8004bf3

SHA512
0bb9890bdcc190a65407d1ef92bf3107d8087d37f7144a819c1fe80b5a835b22ebb46db640b43f689c7363773901b10c4370c6e6772c95c075ffd65c53d34663

Download Submit
C:\Users\Admin\Desktop\README.txt

Filesize
220B

MD5
0899257a400d8dcb5b9df33ed7554875

SHA1
9117ce47fc86a867ef07d4ec18ea1ff8839df406

SHA256
316bb7c0c9ffe478267d5b60d1456e6677a6bf2fd60b38f20c6203a9b2c56e9e

SHA512
e6dfce9b4859eaf7fb36bc3b1ebf01d12c8ed90b1a53954bb593aef02db3a10fd7b6a282dd12f18053c0afe61c20c9b9b269d50ff05ae3a5ccb54aed1bd13eb2

Download Submit
\ProgramData\14499147407041265421.exe

Filesize
7.4MB

MD5
196b4e0f90bdd2c119b7ef9e3a1efa97

SHA1
955bcb5e2bf7f518bc56b8a2e1822498f08110cd

SHA256
5caf93ba3ebc06d7df2e84e9d00f488961850d3d014caa08401a4ab4cb0d75e6

SHA512
76f6292c1ad3bb21c0245be7985580f07587deac287ad91aa484603686b3336160ef0c7926c01860d8821865d20c02801e446d48407a58a182ed94e743ba6002

Download Submit
\ProgramData\14499147407041265421.exe

Filesize
7.4MB

MD5
196b4e0f90bdd2c119b7ef9e3a1efa97

SHA1
955bcb5e2bf7f518bc56b8a2e1822498f08110cd

SHA256
5caf93ba3ebc06d7df2e84e9d00f488961850d3d014caa08401a4ab4cb0d75e6

SHA512
76f6292c1ad3bb21c0245be7985580f07587deac287ad91aa484603686b3336160ef0c7926c01860d8821865d20c02801e446d48407a58a182ed94e743ba6002

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
memory/624-54-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

Filesize
8KB

Download
memory/1676-87-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1676-97-0x0000000051100000-0x00000000511F3000-memory.dmp

Filesize
972KB

Download
memory/1676-96-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1676-95-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download
memory/1676-94-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1676-85-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download