Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    162s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    06/08/2023, 15:23

General

  • Target

    d6a373eb8f771884afc984fba23ff81b034146282f9285e5beaf5eb31d886366.exe

  • Size

    614KB

  • MD5

    f2e35af2013a8cf04a5ab63348b6958d

  • SHA1

    eca2a467462ff167d3511ca0fdd5373228612718

  • SHA256

    d6a373eb8f771884afc984fba23ff81b034146282f9285e5beaf5eb31d886366

  • SHA512

    5609c88267fbf4452c7dd0b2e7bc97e2e02752b2333993ea0e9f91425fd9315b626ada9a392210224ed2fe7da1fdf57e7a74837b38a31ef5b57e18af791a5ad7

  • SSDEEP

    12288:0hqxSLo5C1Ps4XhAjN8GVNoBlR+m651ItSpDvg6q/BCOg:0HLmCiIhoB7oFSzIYtUxg

Malware Config

Extracted

Family

vidar

Version

5

Botnet

43a6ce95ca0edbaf09babc2b3d43fe58

C2

https://t.me/versozaline

https://steamcommunity.com/profiles/76561199532186526

Attributes
  • profile_id_v2

    43a6ce95ca0edbaf09babc2b3d43fe58

  • user_agent

    Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6a373eb8f771884afc984fba23ff81b034146282f9285e5beaf5eb31d886366.exe
    "C:\Users\Admin\AppData\Local\Temp\d6a373eb8f771884afc984fba23ff81b034146282f9285e5beaf5eb31d886366.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2532
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
        work.exe -priverdD
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2104
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\fwa.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\fwa.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          PID:3052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabB9DF.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

    Filesize

    35B

    MD5

    ff59d999beb970447667695ce3273f75

    SHA1

    316fa09f467ba90ac34a054daf2e92e6e2854ff8

    SHA256

    065d2b17ad499587dc9de7ee9ecda4938b45da1df388bc72e6627dff220f64d2

    SHA512

    d5ac72cb065a3cd3cb118a69a2f356314eeed24dcb4880751e1a3683895e66cedc62607967e29f77a0c27adf1c9fe0efd86e804f693f0a63a5b51b0bf0056b5d

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

    Filesize

    35B

    MD5

    ff59d999beb970447667695ce3273f75

    SHA1

    316fa09f467ba90ac34a054daf2e92e6e2854ff8

    SHA256

    065d2b17ad499587dc9de7ee9ecda4938b45da1df388bc72e6627dff220f64d2

    SHA512

    d5ac72cb065a3cd3cb118a69a2f356314eeed24dcb4880751e1a3683895e66cedc62607967e29f77a0c27adf1c9fe0efd86e804f693f0a63a5b51b0bf0056b5d

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe

    Filesize

    472KB

    MD5

    d6e431913e1d69ef6c4ec19ba446f358

    SHA1

    2df7f0c45a010e7a45e746aecfd6234f71e7109e

    SHA256

    1e92acabf037a60e7fbb97c0ba73e997bb4b602ad51333871423b778cae4f0b1

    SHA512

    959f165c8a5d2bc2f186968369ddcbd41a4ce75254e68f649d363d4ac1d1ff501eaef08e8ce03e4c2951155f34dbf2422d57470cf784a5aa29f9e260efd08dc8

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe

    Filesize

    472KB

    MD5

    d6e431913e1d69ef6c4ec19ba446f358

    SHA1

    2df7f0c45a010e7a45e746aecfd6234f71e7109e

    SHA256

    1e92acabf037a60e7fbb97c0ba73e997bb4b602ad51333871423b778cae4f0b1

    SHA512

    959f165c8a5d2bc2f186968369ddcbd41a4ce75254e68f649d363d4ac1d1ff501eaef08e8ce03e4c2951155f34dbf2422d57470cf784a5aa29f9e260efd08dc8

  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\fwa.exe

    Filesize

    467KB

    MD5

    1f389ce8dd14fa092a05104ef99ae174

    SHA1

    bed9a333fde16a8895d443a9b454649e16083b02

    SHA256

    8463de48951e8efed8a7c23cc5bc70a95ef7006f5d620f458f3f9f7732f889ae

    SHA512

    aad444df8f998c73be5819cb5e045a95fe9714aaeb049cc65f89b86770ea44afe277564f0f2fdc88b4cf97aa69b8fe7291f1b22c711c934ac2f0f7fb3bd2895d

  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\fwa.exe

    Filesize

    467KB

    MD5

    1f389ce8dd14fa092a05104ef99ae174

    SHA1

    bed9a333fde16a8895d443a9b454649e16083b02

    SHA256

    8463de48951e8efed8a7c23cc5bc70a95ef7006f5d620f458f3f9f7732f889ae

    SHA512

    aad444df8f998c73be5819cb5e045a95fe9714aaeb049cc65f89b86770ea44afe277564f0f2fdc88b4cf97aa69b8fe7291f1b22c711c934ac2f0f7fb3bd2895d

  • C:\Users\Admin\AppData\Local\Temp\TarBAAD.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • \ProgramData\mozglue.dll

    Filesize

    593KB

    MD5

    c8fd9be83bc728cc04beffafc2907fe9

    SHA1

    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

    SHA256

    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

    SHA512

    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

  • \ProgramData\nss3.dll

    Filesize

    2.0MB

    MD5

    1cc453cdf74f31e4d913ff9c10acdde2

    SHA1

    6e85eae544d6e965f15fa5c39700fa7202f3aafe

    SHA256

    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

    SHA512

    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

  • \Users\Admin\AppData\Local\Temp\RarSFX0\work.exe

    Filesize

    472KB

    MD5

    d6e431913e1d69ef6c4ec19ba446f358

    SHA1

    2df7f0c45a010e7a45e746aecfd6234f71e7109e

    SHA256

    1e92acabf037a60e7fbb97c0ba73e997bb4b602ad51333871423b778cae4f0b1

    SHA512

    959f165c8a5d2bc2f186968369ddcbd41a4ce75254e68f649d363d4ac1d1ff501eaef08e8ce03e4c2951155f34dbf2422d57470cf784a5aa29f9e260efd08dc8

  • \Users\Admin\AppData\Local\Temp\RarSFX1\fwa.exe

    Filesize

    467KB

    MD5

    1f389ce8dd14fa092a05104ef99ae174

    SHA1

    bed9a333fde16a8895d443a9b454649e16083b02

    SHA256

    8463de48951e8efed8a7c23cc5bc70a95ef7006f5d620f458f3f9f7732f889ae

    SHA512

    aad444df8f998c73be5819cb5e045a95fe9714aaeb049cc65f89b86770ea44afe277564f0f2fdc88b4cf97aa69b8fe7291f1b22c711c934ac2f0f7fb3bd2895d

  • \Users\Admin\AppData\Local\Temp\RarSFX1\fwa.exe

    Filesize

    467KB

    MD5

    1f389ce8dd14fa092a05104ef99ae174

    SHA1

    bed9a333fde16a8895d443a9b454649e16083b02

    SHA256

    8463de48951e8efed8a7c23cc5bc70a95ef7006f5d620f458f3f9f7732f889ae

    SHA512

    aad444df8f998c73be5819cb5e045a95fe9714aaeb049cc65f89b86770ea44afe277564f0f2fdc88b4cf97aa69b8fe7291f1b22c711c934ac2f0f7fb3bd2895d

  • \Users\Admin\AppData\Local\Temp\RarSFX1\fwa.exe

    Filesize

    467KB

    MD5

    1f389ce8dd14fa092a05104ef99ae174

    SHA1

    bed9a333fde16a8895d443a9b454649e16083b02

    SHA256

    8463de48951e8efed8a7c23cc5bc70a95ef7006f5d620f458f3f9f7732f889ae

    SHA512

    aad444df8f998c73be5819cb5e045a95fe9714aaeb049cc65f89b86770ea44afe277564f0f2fdc88b4cf97aa69b8fe7291f1b22c711c934ac2f0f7fb3bd2895d

  • \Users\Admin\AppData\Local\Temp\RarSFX1\fwa.exe

    Filesize

    467KB

    MD5

    1f389ce8dd14fa092a05104ef99ae174

    SHA1

    bed9a333fde16a8895d443a9b454649e16083b02

    SHA256

    8463de48951e8efed8a7c23cc5bc70a95ef7006f5d620f458f3f9f7732f889ae

    SHA512

    aad444df8f998c73be5819cb5e045a95fe9714aaeb049cc65f89b86770ea44afe277564f0f2fdc88b4cf97aa69b8fe7291f1b22c711c934ac2f0f7fb3bd2895d

  • memory/3052-138-0x0000000061E00000-0x0000000061EF3000-memory.dmp

    Filesize

    972KB