Analysis

  • max time kernel
    139s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/04/2023, 18:31

General

  • Target

    17c93fb176f59f4887e4a957b6af15270964abf3651540bdca34b0cf91c47428.exe

  • Size

    473KB

  • MD5

    f45a639ab03fd0e37d79c4dcf2859e8e

  • SHA1

    e0dad3add4888c4d530ea257cbec00a2bb1576d3

  • SHA256

    17c93fb176f59f4887e4a957b6af15270964abf3651540bdca34b0cf91c47428

  • SHA512

    85026bb0bee5e567a609aeb8dda93937c55ceaf688c2420c2d754412d6c57b7ab3e7c0baeea2a735908b01715819fd0c39328df74a84661252d8c2aed4a1b787

  • SSDEEP

    6144:lLVOxR07A9fNkmf2pOrUIneA/ht7RiFROewhJ7GaS5IQtipbGZYHE6jlUH92:lxY2AfNkmf2pOnnPht1i3wb8biYZO6

Malware Config

Extracted

Family

vidar

Version

3.4

Botnet

e749025c61b2caca10aa829a9e1a65a1

C2

https://steamcommunity.com/profiles/76561199494593681

https://t.me/auftriebs

Attributes
  • profile_id_v2

    e749025c61b2caca10aa829a9e1a65a1

  • user_agent

    Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0

Extracted

Family

laplas

C2

http://185.106.92.74

Attributes
  • api_key

    bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17c93fb176f59f4887e4a957b6af15270964abf3651540bdca34b0cf91c47428.exe
    "C:\Users\Admin\AppData\Local\Temp\17c93fb176f59f4887e4a957b6af15270964abf3651540bdca34b0cf91c47428.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3948
    • C:\ProgramData\44000429683489268734.exe
      "C:\ProgramData\44000429683489268734.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3316
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\44000429683489268734.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3040
        • C:\Windows\system32\choice.exe
          choice /C Y /N /D Y /T 0
          4⤵
            PID:5068
      • C:\ProgramData\83871838444216533845.exe
        "C:\ProgramData\83871838444216533845.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1252
        • C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
          "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:4560
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\17c93fb176f59f4887e4a957b6af15270964abf3651540bdca34b0cf91c47428.exe" & exit
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1432
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 6
          3⤵
          • Delays execution with timeout.exe
          PID:1620
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 1644
        2⤵
        • Program crash
        PID:4240
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 1560
        2⤵
        • Program crash
        PID:3060
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3948 -ip 3948
      1⤵
        PID:1400
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3948 -ip 3948
        1⤵
          PID:4816

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\44000429683489268734.exe

          Filesize

          4.3MB

          MD5

          c4ab3149ef02a36d663699a8c541933e

          SHA1

          67088f5eff9ec575775b711c9e3650d12d7f4d5c

          SHA256

          0a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce

          SHA512

          88b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4

        • C:\ProgramData\44000429683489268734.exe

          Filesize

          4.3MB

          MD5

          c4ab3149ef02a36d663699a8c541933e

          SHA1

          67088f5eff9ec575775b711c9e3650d12d7f4d5c

          SHA256

          0a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce

          SHA512

          88b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4

        • C:\ProgramData\44000429683489268734.exe

          Filesize

          4.3MB

          MD5

          c4ab3149ef02a36d663699a8c541933e

          SHA1

          67088f5eff9ec575775b711c9e3650d12d7f4d5c

          SHA256

          0a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce

          SHA512

          88b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4

        • C:\ProgramData\83871838444216533845.exe

          Filesize

          6.7MB

          MD5

          3bc6d011a6c3d265bcc0f04075eaaf0e

          SHA1

          a2b389d5a0fd9e06c33eba512aa6ac51cee53e0d

          SHA256

          c73e76cac5d6f6b9dae7327586d2240db1eff444fca0689f23c2f66d9737f7fa

          SHA512

          0b75a073d6952a901738d30b04aaf911f57434b44f339c320a3815bbffe606ae52a2ff5fdc473a1e9aa1162e567705b4767630e1378ff1538b2d96c963aed3ed

        • C:\ProgramData\83871838444216533845.exe

          Filesize

          6.7MB

          MD5

          3bc6d011a6c3d265bcc0f04075eaaf0e

          SHA1

          a2b389d5a0fd9e06c33eba512aa6ac51cee53e0d

          SHA256

          c73e76cac5d6f6b9dae7327586d2240db1eff444fca0689f23c2f66d9737f7fa

          SHA512

          0b75a073d6952a901738d30b04aaf911f57434b44f339c320a3815bbffe606ae52a2ff5fdc473a1e9aa1162e567705b4767630e1378ff1538b2d96c963aed3ed

        • C:\ProgramData\83871838444216533845.exe

          Filesize

          6.7MB

          MD5

          3bc6d011a6c3d265bcc0f04075eaaf0e

          SHA1

          a2b389d5a0fd9e06c33eba512aa6ac51cee53e0d

          SHA256

          c73e76cac5d6f6b9dae7327586d2240db1eff444fca0689f23c2f66d9737f7fa

          SHA512

          0b75a073d6952a901738d30b04aaf911f57434b44f339c320a3815bbffe606ae52a2ff5fdc473a1e9aa1162e567705b4767630e1378ff1538b2d96c963aed3ed

        • C:\ProgramData\mozglue.dll

          Filesize

          593KB

          MD5

          c8fd9be83bc728cc04beffafc2907fe9

          SHA1

          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

          SHA256

          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

          SHA512

          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

        • C:\ProgramData\nss3.dll

          Filesize

          2.0MB

          MD5

          1cc453cdf74f31e4d913ff9c10acdde2

          SHA1

          6e85eae544d6e965f15fa5c39700fa7202f3aafe

          SHA256

          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

          SHA512

          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

        • C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

          Filesize

          638.4MB

          MD5

          a1fcd33d0b877c7cf91e13e4c53e6af1

          SHA1

          612e98437587f0b8d2bb919313b845e77f59bc6b

          SHA256

          b019ca87ac9e17a0ec498fc3bbf9a2a259447ceb42f37d2c509df729d81e4265

          SHA512

          f1d782cb35c3f2491df21be747a18b6aa1ff48e43f331bd7f9d864223be49e7bdc52f2c9827ff0a3e13e3eefa16d6ddbca8e5181deb568036a4057564fda74f2

        • C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

          Filesize

          623.9MB

          MD5

          efa8bb738eaa00e7334f016bd656e968

          SHA1

          f1772cdc3e41e144ec4a0be32885f2d0fcdd544d

          SHA256

          052386c687c54ebb46865fc4b855fef7ebdf50ce736a9d8050971a80114d6631

          SHA512

          9638cc11328f5b36aeb6029091db691723de9d79c02c0d8f55e1cd7f5b3bebe0bb558ff710b2475c592e4360d58873112b43dd684ee9f9588fbe9fc20b5536d8

        • memory/1252-242-0x00000000005B0000-0x0000000001015000-memory.dmp

          Filesize

          10.4MB

        • memory/1252-241-0x0000000000590000-0x0000000000591000-memory.dmp

          Filesize

          4KB

        • memory/3316-228-0x0000000000470000-0x00000000012D3000-memory.dmp

          Filesize

          14.4MB

        • memory/3316-232-0x0000000000470000-0x00000000012D3000-memory.dmp

          Filesize

          14.4MB

        • memory/3948-135-0x0000000000400000-0x000000000081C000-memory.dmp

          Filesize

          4.1MB

        • memory/3948-134-0x0000000000AD0000-0x0000000000B27000-memory.dmp

          Filesize

          348KB

        • memory/3948-136-0x0000000000AD0000-0x0000000000B27000-memory.dmp

          Filesize

          348KB

        • memory/3948-138-0x0000000000400000-0x000000000081C000-memory.dmp

          Filesize

          4.1MB

        • memory/3948-245-0x0000000000400000-0x000000000081C000-memory.dmp

          Filesize

          4.1MB

        • memory/3948-143-0x0000000061E00000-0x0000000061EF3000-memory.dmp

          Filesize

          972KB

        • memory/3948-219-0x0000000000400000-0x000000000081C000-memory.dmp

          Filesize

          4.1MB

        • memory/4560-258-0x0000000001600000-0x0000000001601000-memory.dmp

          Filesize

          4KB

        • memory/4560-259-0x00000000006A0000-0x0000000001105000-memory.dmp

          Filesize

          10.4MB