Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    20/04/2023, 05:33

General

  • Target

    Setup.exe

  • Size

    1011.0MB

  • MD5

    d35a4d0264151fe12392c2de7b862df5

  • SHA1

    2db6d67aa751316ce81b539c29283e6fdf7ea127

  • SHA256

    bff00b68ddba7142583a95fe90cb337ba59fef25fc0696847a19b60a4a782e6a

  • SHA512

    eb5b22d44e90d70da0e6142b5a4725f1475a0db5c132aa783b11abc54fde6c7b51d31644be34de0fd27eb69598c592fbf9a289cb36e698c460bd7187f38069a9

  • SSDEEP

    24576:cMOCW00r5wCxnzmkMDghx9qinBSl6QOM6LvFuPROlW5wwwwwwwwwwwwwwwwwwwwQ:bBW00GCZ6e5rdu8lWK

Malware Config

Extracted

Family

vidar

Version

3.5

Botnet

395ff08de6af5e2dbf2e94b1ee2175c2

C2

https://steamcommunity.com/profiles/76561199497218285

https://t.me/tg_duckworld

Attributes
  • profile_id_v2

    395ff08de6af5e2dbf2e94b1ee2175c2

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Vivaldi/3.7

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1396
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
      2⤵
        PID:1736
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
        2⤵
          PID:2016
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
          2⤵
            PID:2012
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
            2⤵
              PID:612
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
              2⤵
                PID:1840
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"
                2⤵
                  PID:996
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
                  2⤵
                    PID:472
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
                    2⤵
                      PID:1060
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
                      2⤵
                      • Loads dropped DLL
                      PID:772

                  Network

                  MITRE ATT&CK Matrix

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                    Filesize

                    61KB

                    MD5

                    e71c8443ae0bc2e282c73faead0a6dd3

                    SHA1

                    0c110c1b01e68edfacaeae64781a37b1995fa94b

                    SHA256

                    95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

                    SHA512

                    b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

                  • C:\Users\Admin\AppData\Local\Temp\Tar1379.tmp

                    Filesize

                    161KB

                    MD5

                    be2bec6e8c5653136d3e72fe53c98aa3

                    SHA1

                    a8182d6db17c14671c3d5766c72e58d87c0810de

                    SHA256

                    1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

                    SHA512

                    0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

                  • \ProgramData\mozglue.dll

                    Filesize

                    593KB

                    MD5

                    c8fd9be83bc728cc04beffafc2907fe9

                    SHA1

                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                    SHA256

                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                    SHA512

                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                  • \ProgramData\nss3.dll

                    Filesize

                    2.0MB

                    MD5

                    1cc453cdf74f31e4d913ff9c10acdde2

                    SHA1

                    6e85eae544d6e965f15fa5c39700fa7202f3aafe

                    SHA256

                    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                    SHA512

                    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                  • memory/772-57-0x0000000000400000-0x000000000048F000-memory.dmp

                    Filesize

                    572KB

                  • memory/772-59-0x0000000000400000-0x000000000048F000-memory.dmp

                    Filesize

                    572KB

                  • memory/772-60-0x0000000000400000-0x000000000048F000-memory.dmp

                    Filesize

                    572KB

                  • memory/772-112-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                    Filesize

                    972KB

                  • memory/1396-54-0x00000000010B0000-0x00000000011C2000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1396-55-0x000000001B140000-0x000000001B1C0000-memory.dmp

                    Filesize

                    512KB

                  • memory/1396-56-0x0000000000A50000-0x0000000000B0E000-memory.dmp

                    Filesize

                    760KB