Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06-06-2023 17:06

General

  • Target

    bank_statement.scr.exe

  • Size

    37.0MB

  • MD5

    61e6735126b6504424d090ac796f8a49

  • SHA1

    7e8838d573b193beedfa12ff74e1e4933944587a

  • SHA256

    c8e45719240f875784086abcc66cdbf68a102c1d3d5edabb0c7da44516621e51

  • SHA512

    b24367cca3405aed1f55517242b4680d94cc149ba8bc112af5eb37ba2c86e873a11b7ee117138a0ffc1597e6e175d2d1f9db0c79188cb9cbc5d2cfb5edf3ed9c

  • SSDEEP

    393216:NS3GX6iThaMcP5L56QHbe/klf3FWpis6n93CnVspY9rw20amy/dtzEvQ4iD6t+t2:a3iTkFVBn9Tpkw3dUzMri2ty7I9

Malware Config

Extracted

Family

vidar

Version

4.2

Botnet

655d9e590e95375f4ab0b3055662ab2e

C2

https://steamcommunity.com/profiles/76561199511129510

https://t.me/rechnungsbetrag

Attributes
  • profile_id_v2

    655d9e590e95375f4ab0b3055662ab2e

  • user_agent

    Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.38 Safari/537.36 Brave/75

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bank_statement.scr.exe
    "C:\Users\Admin\AppData\Local\Temp\bank_statement.scr.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1124
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMwA=
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:688
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      2⤵
      • Loads dropped DLL
      PID:1916
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAANQA=
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1276

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar88C7.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    883c6b9e509f3a81b9309c40836ebd2d

    SHA1

    0399971596cb2bd77d293dc2bc87d44d0ca96dbe

    SHA256

    09f59eb9dcfdb5c916e4927e4edf09df4464ef83157e35d87d7d3a919d773914

    SHA512

    e5f93b99b65d438f97ad15f82acd8ec67ac6f9430a8a53eefe5e383a8614d485e0a501875bd54c077fe0e0aad2168cd8e975c7ee4958713f1474e918c6a4ec1b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TJIVOZ6G0O51ETEM0WDS.temp

    Filesize

    7KB

    MD5

    883c6b9e509f3a81b9309c40836ebd2d

    SHA1

    0399971596cb2bd77d293dc2bc87d44d0ca96dbe

    SHA256

    09f59eb9dcfdb5c916e4927e4edf09df4464ef83157e35d87d7d3a919d773914

    SHA512

    e5f93b99b65d438f97ad15f82acd8ec67ac6f9430a8a53eefe5e383a8614d485e0a501875bd54c077fe0e0aad2168cd8e975c7ee4958713f1474e918c6a4ec1b

  • \ProgramData\mozglue.dll

    Filesize

    593KB

    MD5

    c8fd9be83bc728cc04beffafc2907fe9

    SHA1

    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

    SHA256

    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

    SHA512

    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

  • \ProgramData\nss3.dll

    Filesize

    2.0MB

    MD5

    1cc453cdf74f31e4d913ff9c10acdde2

    SHA1

    6e85eae544d6e965f15fa5c39700fa7202f3aafe

    SHA256

    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

    SHA512

    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

  • memory/688-83-0x000000001B120000-0x000000001B402000-memory.dmp

    Filesize

    2.9MB

  • memory/688-88-0x0000000002310000-0x0000000002390000-memory.dmp

    Filesize

    512KB

  • memory/688-84-0x00000000023A0000-0x00000000023A8000-memory.dmp

    Filesize

    32KB

  • memory/688-87-0x0000000002310000-0x0000000002390000-memory.dmp

    Filesize

    512KB

  • memory/688-86-0x0000000002310000-0x0000000002390000-memory.dmp

    Filesize

    512KB

  • memory/688-85-0x0000000002310000-0x0000000002390000-memory.dmp

    Filesize

    512KB

  • memory/1124-65-0x0000000077000000-0x0000000077002000-memory.dmp

    Filesize

    8KB

  • memory/1124-54-0x0000000076FD0000-0x0000000076FD2000-memory.dmp

    Filesize

    8KB

  • memory/1124-68-0x0000000077010000-0x0000000077012000-memory.dmp

    Filesize

    8KB

  • memory/1124-70-0x000007FEFCFF0000-0x000007FEFCFF2000-memory.dmp

    Filesize

    8KB

  • memory/1124-71-0x000007FEFCFF0000-0x000007FEFCFF2000-memory.dmp

    Filesize

    8KB

  • memory/1124-73-0x000007FEFD180000-0x000007FEFD182000-memory.dmp

    Filesize

    8KB

  • memory/1124-74-0x000007FEFD180000-0x000007FEFD182000-memory.dmp

    Filesize

    8KB

  • memory/1124-75-0x000000013F4C0000-0x000000014310C000-memory.dmp

    Filesize

    60.3MB

  • memory/1124-66-0x0000000077010000-0x0000000077012000-memory.dmp

    Filesize

    8KB

  • memory/1124-58-0x0000000076FE0000-0x0000000076FE2000-memory.dmp

    Filesize

    8KB

  • memory/1124-64-0x0000000077000000-0x0000000077002000-memory.dmp

    Filesize

    8KB

  • memory/1124-63-0x0000000077000000-0x0000000077002000-memory.dmp

    Filesize

    8KB

  • memory/1124-62-0x0000000076FF0000-0x0000000076FF2000-memory.dmp

    Filesize

    8KB

  • memory/1124-61-0x0000000076FF0000-0x0000000076FF2000-memory.dmp

    Filesize

    8KB

  • memory/1124-60-0x0000000076FF0000-0x0000000076FF2000-memory.dmp

    Filesize

    8KB

  • memory/1124-59-0x0000000076FE0000-0x0000000076FE2000-memory.dmp

    Filesize

    8KB

  • memory/1124-55-0x0000000076FD0000-0x0000000076FD2000-memory.dmp

    Filesize

    8KB

  • memory/1124-67-0x0000000077010000-0x0000000077012000-memory.dmp

    Filesize

    8KB

  • memory/1124-56-0x0000000076FD0000-0x0000000076FD2000-memory.dmp

    Filesize

    8KB

  • memory/1124-57-0x0000000076FE0000-0x0000000076FE2000-memory.dmp

    Filesize

    8KB

  • memory/1276-94-0x0000000002920000-0x00000000029A0000-memory.dmp

    Filesize

    512KB

  • memory/1276-98-0x0000000002920000-0x00000000029A0000-memory.dmp

    Filesize

    512KB

  • memory/1276-95-0x000000001B280000-0x000000001B562000-memory.dmp

    Filesize

    2.9MB

  • memory/1276-97-0x0000000002920000-0x00000000029A0000-memory.dmp

    Filesize

    512KB

  • memory/1276-99-0x0000000002920000-0x00000000029A0000-memory.dmp

    Filesize

    512KB

  • memory/1276-96-0x0000000002390000-0x0000000002398000-memory.dmp

    Filesize

    32KB

  • memory/1916-102-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/1916-105-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/1916-106-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1916-108-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/1916-104-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/1916-103-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/1916-160-0x0000000061E00000-0x0000000061EF3000-memory.dmp

    Filesize

    972KB

  • memory/1916-101-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/1916-100-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB