Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    02-06-2023 22:14

General

  • Target

    bank_statement.scr

  • Size

    25MB

  • MD5

    dedd66f7cdc48224fb7fcbc795f69bfd

  • SHA1

    00ab7277c89b9f0608f00997b219881a92e36888

  • SHA256

    b11e85d0eed98a012f018c818f72a0bc0d0521ea132a45a58f5de92da924c225

  • SHA512

    4ea3119416c786ec9667eaa499b3af40d196f4ecf2ffaac5e5b78ccbaba34ab867e302a10fc7964dc95284fafcffdeca3361886dffdc2c2ba2bf2fb5e664b8c3

  • SSDEEP

    393216:iEbUSKA4SNAwLpQfgVehx8oyLZ8Ae0sCK9UCUQkiWajOHkzhSbfA:7bUXA4Vv9eoyt8Ae07K2CUdiWajOHe

Malware Config

Extracted

Family

vidar

Version

4.1

Botnet

850dc0663d2676536f88b82b3382fcb4

C2

https://steamcommunity.com/profiles/76561199510444991

https://t.me/task4manager

Attributes
  • profile_id_v2

    850dc0663d2676536f88b82b3382fcb4

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 Edg/112.0.1722.34

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Loads dropped DLL 2 IoCs
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 39 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bank_statement.scr
    "C:\Users\Admin\AppData\Local\Temp\bank_statement.scr" /S
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1424
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMwA=
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1160
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      2⤵
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:1516
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAANQA=
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:948
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1692
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x57c
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1628

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar8FC9.tmp
    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
    Filesize

    7KB

    MD5

    fd9d040753760deda0e891f460698051

    SHA1

    c679bd4e008fbe8a37287fbcd8b87cba24be9814

    SHA256

    71930584032a82fd78f8b262224b8bceeb95d04469cbec6122bd083199fc4555

    SHA512

    2d2d4bf225b00346b497812c3c277afbb0e3050670a93983d97c18af3bc676ce1372951c0b3f6f0b2122098500b07a6c54a72289bc3b98c19ad8b02b09870698

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OATCOFED9REHWOE6JQ1J.temp
    Filesize

    7KB

    MD5

    fd9d040753760deda0e891f460698051

    SHA1

    c679bd4e008fbe8a37287fbcd8b87cba24be9814

    SHA256

    71930584032a82fd78f8b262224b8bceeb95d04469cbec6122bd083199fc4555

    SHA512

    2d2d4bf225b00346b497812c3c277afbb0e3050670a93983d97c18af3bc676ce1372951c0b3f6f0b2122098500b07a6c54a72289bc3b98c19ad8b02b09870698

  • \ProgramData\mozglue.dll
    Filesize

    593KB

    MD5

    c8fd9be83bc728cc04beffafc2907fe9

    SHA1

    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

    SHA256

    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

    SHA512

    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

  • \ProgramData\nss3.dll
    Filesize

    1MB

    MD5

    1cc453cdf74f31e4d913ff9c10acdde2

    SHA1

    6e85eae544d6e965f15fa5c39700fa7202f3aafe

    SHA256

    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

    SHA512

    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

  • memory/948-95-0x0000000002320000-0x0000000002328000-memory.dmp
    Filesize

    32KB

  • memory/948-97-0x0000000002800000-0x0000000002880000-memory.dmp
    Filesize

    512KB

  • memory/948-96-0x0000000002800000-0x0000000002880000-memory.dmp
    Filesize

    512KB

  • memory/948-98-0x0000000002800000-0x0000000002880000-memory.dmp
    Filesize

    512KB

  • memory/948-94-0x000000001B1D0000-0x000000001B4B2000-memory.dmp
    Filesize

    2MB

  • memory/948-99-0x0000000002800000-0x0000000002880000-memory.dmp
    Filesize

    512KB

  • memory/1160-83-0x0000000002400000-0x0000000002480000-memory.dmp
    Filesize

    512KB

  • memory/1160-88-0x0000000002400000-0x0000000002480000-memory.dmp
    Filesize

    512KB

  • memory/1160-87-0x0000000002400000-0x0000000002480000-memory.dmp
    Filesize

    512KB

  • memory/1160-86-0x0000000002400000-0x0000000002480000-memory.dmp
    Filesize

    512KB

  • memory/1160-85-0x00000000022A0000-0x00000000022A8000-memory.dmp
    Filesize

    32KB

  • memory/1160-84-0x000000001B200000-0x000000001B4E2000-memory.dmp
    Filesize

    2MB

  • memory/1424-66-0x0000000077250000-0x0000000077252000-memory.dmp
    Filesize

    8KB

  • memory/1424-65-0x0000000077240000-0x0000000077242000-memory.dmp
    Filesize

    8KB

  • memory/1424-74-0x000007FEFCF60000-0x000007FEFCF62000-memory.dmp
    Filesize

    8KB

  • memory/1424-73-0x000007FEFCF60000-0x000007FEFCF62000-memory.dmp
    Filesize

    8KB

  • memory/1424-71-0x000007FEFCF50000-0x000007FEFCF52000-memory.dmp
    Filesize

    8KB

  • memory/1424-70-0x000007FEFCF50000-0x000007FEFCF52000-memory.dmp
    Filesize

    8KB

  • memory/1424-68-0x0000000077250000-0x0000000077252000-memory.dmp
    Filesize

    8KB

  • memory/1424-67-0x0000000077250000-0x0000000077252000-memory.dmp
    Filesize

    8KB

  • memory/1424-55-0x0000000077210000-0x0000000077212000-memory.dmp
    Filesize

    8KB

  • memory/1424-58-0x0000000077220000-0x0000000077222000-memory.dmp
    Filesize

    8KB

  • memory/1424-64-0x0000000077240000-0x0000000077242000-memory.dmp
    Filesize

    8KB

  • memory/1424-63-0x0000000077240000-0x0000000077242000-memory.dmp
    Filesize

    8KB

  • memory/1424-62-0x0000000077230000-0x0000000077232000-memory.dmp
    Filesize

    8KB

  • memory/1424-61-0x0000000077230000-0x0000000077232000-memory.dmp
    Filesize

    8KB

  • memory/1424-60-0x0000000077230000-0x0000000077232000-memory.dmp
    Filesize

    8KB

  • memory/1424-59-0x0000000077220000-0x0000000077222000-memory.dmp
    Filesize

    8KB

  • memory/1424-54-0x0000000077210000-0x0000000077212000-memory.dmp
    Filesize

    8KB

  • memory/1424-75-0x0000000140000000-0x00000001428FF000-memory.dmp
    Filesize

    40MB

  • memory/1424-56-0x0000000077210000-0x0000000077212000-memory.dmp
    Filesize

    8KB

  • memory/1424-57-0x0000000077220000-0x0000000077222000-memory.dmp
    Filesize

    8KB

  • memory/1516-101-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

  • memory/1516-105-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

  • memory/1516-106-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
    Filesize

    4KB

  • memory/1516-108-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

  • memory/1516-104-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

  • memory/1516-103-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

  • memory/1516-162-0x0000000061E00000-0x0000000061EF3000-memory.dmp
    Filesize

    972KB

  • memory/1516-102-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

  • memory/1516-100-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

  • memory/1516-212-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

  • memory/1516-213-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

  • memory/1692-109-0x0000000140000000-0x00000001405E8000-memory.dmp
    Filesize

    5MB

  • memory/1692-110-0x0000000140000000-0x00000001405E8000-memory.dmp
    Filesize

    5MB