Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    160s
  • max time network
    174s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/10/2023, 18:26

General

  • Target

    Reservation information (date, name and etc)/Reservation information (date, name and etc).exe

  • Size

    92.9MB

  • MD5

    9809cc75b12ebaa98003f8288978f3b3

  • SHA1

    94a5a71d6548ea8aab5b03f5bc8dcd2c559ed084

  • SHA256

    dd5ed75d01cbe4f1957df72a058656e7b45cb1e2e74efa6eb796fe9a7012a173

  • SHA512

    6421e8cf53d93dcd48529ba7ec34a8b7cdf24d34886bee3828f12385942619e89345b205d0201faffaad60a0dd34dd9cc243230f2c4b9f5ce75bc1cb684125cf

  • SSDEEP

    1572864:Th4QkjGuWsqebzyuGqNMnKuEqHhaPd5nC8DDkeZZZZZsOKa1pVeOKCr7ZPE:l43jRWshbzyuNMnlEqIPrzDkeZZZZZsR

Malware Config

Extracted

Family

vidar

Version

5.9

Botnet

3ea14c104bd4d544fa30377b4df192a6

C2

https://t.me/grizmons

https://steamcommunity.com/profiles/76561199557479327

http://94.228.162.50:80

Attributes
  • profile_id_v2

    3ea14c104bd4d544fa30377b4df192a6

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 OPR/104.0.0.0

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 12 IoCs
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3172
      • C:\Users\Admin\AppData\Local\Temp\Reservation information (date, name and etc)\Reservation information (date, name and etc).exe
        "C:\Users\Admin\AppData\Local\Temp\Reservation information (date, name and etc)\Reservation information (date, name and etc).exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4772
      • C:\Users\Admin\AppData\Roaming\IcTask_v2\mergecap.exe
        C:\Users\Admin\AppData\Roaming\IcTask_v2\mergecap.exe
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2160
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:1420
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            4⤵
            • Loads dropped DLL
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            PID:5044
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 1476
              5⤵
              • Program crash
              PID:1556
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5044 -ip 5044
      1⤵
        PID:4136

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\mozglue.dll

        Filesize

        593KB

        MD5

        c8fd9be83bc728cc04beffafc2907fe9

        SHA1

        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

        SHA256

        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

        SHA512

        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

      • C:\ProgramData\nss3.dll

        Filesize

        2.0MB

        MD5

        1cc453cdf74f31e4d913ff9c10acdde2

        SHA1

        6e85eae544d6e965f15fa5c39700fa7202f3aafe

        SHA256

        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

        SHA512

        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

      • C:\Users\Admin\AppData\Local\Temp\22e765e5

        Filesize

        893KB

        MD5

        f5f6fd1a879dd2d0724e2d356e26fab9

        SHA1

        8501c7fcd3ee46b1b73c5885acb29374d1cbc361

        SHA256

        aed2b4635ea158afc2303a4f9d6ff2f264dce068c3e6f1ea3fcb5065451293be

        SHA512

        91dd8ccf269fca55801a469160d4d8a5bcfe5734fcb5d217761c6a005183f287a93e21d41d2298a0948aea1370d57561c6f57e70da639ab4a3adfea48c23a2d7

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\MSVCR100.dll

        Filesize

        809KB

        MD5

        366fd6f3a451351b5df2d7c4ecf4c73a

        SHA1

        50db750522b9630757f91b53df377fd4ed4e2d66

        SHA256

        ae3cb6c6afba9a4aa5c85f66023c35338ca579b30326dd02918f9d55259503d5

        SHA512

        2de764772b68a85204b7435c87e9409d753c2196cf5b2f46e7796c99a33943e167f62a92e8753eaa184cd81fb14361e83228eb1b474e0c3349ed387ec93e6130

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\libglib-2.0-0.dll

        Filesize

        1.1MB

        MD5

        2f2bfc6119daa63bfde98927878388e7

        SHA1

        8b2f941ea6c8a5968be871b68e6dc2fe0fce6d17

        SHA256

        6a15b04430c503427cdd70c442389cbb66a2a0e1dd57f2d1535d3aa389df47b0

        SHA512

        b3333d915d5b979b2683bfee3ed9beb4ec78b7ef74bede79fa1b31941ec9037f31439ca2f350d11842b021b57f708053cab5dc6c656175321e086df3760e392d

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\libglib-2.0-0.dll

        Filesize

        1.1MB

        MD5

        2f2bfc6119daa63bfde98927878388e7

        SHA1

        8b2f941ea6c8a5968be871b68e6dc2fe0fce6d17

        SHA256

        6a15b04430c503427cdd70c442389cbb66a2a0e1dd57f2d1535d3aa389df47b0

        SHA512

        b3333d915d5b979b2683bfee3ed9beb4ec78b7ef74bede79fa1b31941ec9037f31439ca2f350d11842b021b57f708053cab5dc6c656175321e086df3760e392d

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\libglib-2.0-0.dll

        Filesize

        1.1MB

        MD5

        2f2bfc6119daa63bfde98927878388e7

        SHA1

        8b2f941ea6c8a5968be871b68e6dc2fe0fce6d17

        SHA256

        6a15b04430c503427cdd70c442389cbb66a2a0e1dd57f2d1535d3aa389df47b0

        SHA512

        b3333d915d5b979b2683bfee3ed9beb4ec78b7ef74bede79fa1b31941ec9037f31439ca2f350d11842b021b57f708053cab5dc6c656175321e086df3760e392d

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\libglib-2.0-0.dll

        Filesize

        1.1MB

        MD5

        2f2bfc6119daa63bfde98927878388e7

        SHA1

        8b2f941ea6c8a5968be871b68e6dc2fe0fce6d17

        SHA256

        6a15b04430c503427cdd70c442389cbb66a2a0e1dd57f2d1535d3aa389df47b0

        SHA512

        b3333d915d5b979b2683bfee3ed9beb4ec78b7ef74bede79fa1b31941ec9037f31439ca2f350d11842b021b57f708053cab5dc6c656175321e086df3760e392d

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\libglib-2.0-0.dll

        Filesize

        1.1MB

        MD5

        2f2bfc6119daa63bfde98927878388e7

        SHA1

        8b2f941ea6c8a5968be871b68e6dc2fe0fce6d17

        SHA256

        6a15b04430c503427cdd70c442389cbb66a2a0e1dd57f2d1535d3aa389df47b0

        SHA512

        b3333d915d5b979b2683bfee3ed9beb4ec78b7ef74bede79fa1b31941ec9037f31439ca2f350d11842b021b57f708053cab5dc6c656175321e086df3760e392d

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\libgmodule-2.0-0.dll

        Filesize

        46KB

        MD5

        5bdd314fb97d92743e0f84978af7197e

        SHA1

        f7b89279588b49f4c51930cf12424f8944d31664

        SHA256

        a72cb7f636483c65fc027d09608a4b0a681d3665fcfa93e5e8258f1c96f5cc09

        SHA512

        d952c757913091e6b6dc71abe2c51c11a10c32ec9f3e221337ad3a584402605dca548bb088d784a176b43de7184742636e44842ae050c1fd2b4ac6fc0261e57b

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\libgmodule-2.0-0.dll

        Filesize

        46KB

        MD5

        5bdd314fb97d92743e0f84978af7197e

        SHA1

        f7b89279588b49f4c51930cf12424f8944d31664

        SHA256

        a72cb7f636483c65fc027d09608a4b0a681d3665fcfa93e5e8258f1c96f5cc09

        SHA512

        d952c757913091e6b6dc71abe2c51c11a10c32ec9f3e221337ad3a584402605dca548bb088d784a176b43de7184742636e44842ae050c1fd2b4ac6fc0261e57b

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\libintl-8.dll

        Filesize

        135KB

        MD5

        7bd6d0d9a7ebd9e76d1c6f9ef7d13b81

        SHA1

        92e570a5c331c337ae42d1b5dd8f8b003e6fe320

        SHA256

        0416287740e35886e1721cbb3379525a3850d96a5f20f330d2ee5d2b03f272c9

        SHA512

        bd44ef64d8bd1f0fe703e6856cd881f7ff0f93238b9cbc918d145f867a562284346b3cce84dc1d2e62311139798600d9118eb70d67cad1995bdd60b87ae5b717

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\libintl-8.dll

        Filesize

        135KB

        MD5

        7bd6d0d9a7ebd9e76d1c6f9ef7d13b81

        SHA1

        92e570a5c331c337ae42d1b5dd8f8b003e6fe320

        SHA256

        0416287740e35886e1721cbb3379525a3850d96a5f20f330d2ee5d2b03f272c9

        SHA512

        bd44ef64d8bd1f0fe703e6856cd881f7ff0f93238b9cbc918d145f867a562284346b3cce84dc1d2e62311139798600d9118eb70d67cad1995bdd60b87ae5b717

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\libwsutil.dll

        Filesize

        56KB

        MD5

        0a8bc2c0ae8ba47c3397b1c1a1fb18d0

        SHA1

        22b7cc6c10ce9a4417a0bc65663385160a480b7d

        SHA256

        bdda1fef013640dfd7980481963bc837c556e6342d7184dd6f4c5454122bc9f2

        SHA512

        2c1ee3593b124db4a0c96dfdd44ba599f365bd19bbd7638220cb9cd91d487dbfdd531c28782849342225b3461982cfd34fb29ec8a8e0bb65f308b99937288f68

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\libwsutil.dll

        Filesize

        56KB

        MD5

        0a8bc2c0ae8ba47c3397b1c1a1fb18d0

        SHA1

        22b7cc6c10ce9a4417a0bc65663385160a480b7d

        SHA256

        bdda1fef013640dfd7980481963bc837c556e6342d7184dd6f4c5454122bc9f2

        SHA512

        2c1ee3593b124db4a0c96dfdd44ba599f365bd19bbd7638220cb9cd91d487dbfdd531c28782849342225b3461982cfd34fb29ec8a8e0bb65f308b99937288f68

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\mergecap.exe

        Filesize

        39KB

        MD5

        23ba27d352305f29d201ac5e43fc4583

        SHA1

        7c7720604bb82351dfba857837d64b360cd715b2

        SHA256

        ac7a321a7b00b4adb5863b9a7e91e69afe9ce1953317234a2bd1bee97de744da

        SHA512

        4c96ea8b6e21415f8004bc1ce037e406f3086991e9d401d14986602905616a6ad962fa71673f914327cae6a4f8381365330a94467e0d5be1d287f2bea175b599

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\mergecap.exe

        Filesize

        39KB

        MD5

        23ba27d352305f29d201ac5e43fc4583

        SHA1

        7c7720604bb82351dfba857837d64b360cd715b2

        SHA256

        ac7a321a7b00b4adb5863b9a7e91e69afe9ce1953317234a2bd1bee97de744da

        SHA512

        4c96ea8b6e21415f8004bc1ce037e406f3086991e9d401d14986602905616a6ad962fa71673f914327cae6a4f8381365330a94467e0d5be1d287f2bea175b599

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\msvcr100.dll

        Filesize

        809KB

        MD5

        366fd6f3a451351b5df2d7c4ecf4c73a

        SHA1

        50db750522b9630757f91b53df377fd4ed4e2d66

        SHA256

        ae3cb6c6afba9a4aa5c85f66023c35338ca579b30326dd02918f9d55259503d5

        SHA512

        2de764772b68a85204b7435c87e9409d753c2196cf5b2f46e7796c99a33943e167f62a92e8753eaa184cd81fb14361e83228eb1b474e0c3349ed387ec93e6130

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\semiconductor.csv

        Filesize

        820KB

        MD5

        15c6784bdaa973bad5e17ed0861a88a4

        SHA1

        98e2c8c58a44f4cfb587663b92180c8316fc1c03

        SHA256

        7a6a08f9bad430b868321b5a5b89605c6d37d119696449f8018985c77d7bace8

        SHA512

        bb16aa70368b8bfe4dc33df7648dad2fc4ffae0c37560fd0684ccb17ac6b6cf1c481732870c3bb19fd13b25e97e7220d1e36b6819af2cad8fc71fd104f3caa52

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\wiretap-1.8.0.dll

        Filesize

        427KB

        MD5

        d5d9b110f735c7789fdc453e1574a1ca

        SHA1

        f5d4791322e590d3d3d1ac3fd2d8d3eca093e1d6

        SHA256

        657c215af84f023ab69878ffddcb12ec15d177a84ec2820992f1821639ed2063

        SHA512

        12901c75cc065863f5ecc5137157415f281adc0bfe31f63bfeb4541d6a352f78ee1d80b3b5f6b0d58a215ee81a2cafcd6a1a2553605d339880163ee3fff03a2c

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\wiretap-1.8.0.dll

        Filesize

        427KB

        MD5

        d5d9b110f735c7789fdc453e1574a1ca

        SHA1

        f5d4791322e590d3d3d1ac3fd2d8d3eca093e1d6

        SHA256

        657c215af84f023ab69878ffddcb12ec15d177a84ec2820992f1821639ed2063

        SHA512

        12901c75cc065863f5ecc5137157415f281adc0bfe31f63bfeb4541d6a352f78ee1d80b3b5f6b0d58a215ee81a2cafcd6a1a2553605d339880163ee3fff03a2c

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\zlib1.dll

        Filesize

        75KB

        MD5

        baa55c842556eda179ff7a363303e179

        SHA1

        1764945d5ec4b156629a354fb8f261aa3d9bc3b4

        SHA256

        8296b847f9aaef1ebc0296cf83c1db5b29d17aced1335ee16968d332cbf4854a

        SHA512

        901e9bd28afef9378aa764068281544efe941597bd1f86b6b8f7903e069092489012f86bc7d60cc41ac9276458ced49f6ad04505b791d73ee7080a30d1aaecf5

      • C:\Users\Admin\AppData\Roaming\IcTask_v2\zlib1.dll

        Filesize

        75KB

        MD5

        baa55c842556eda179ff7a363303e179

        SHA1

        1764945d5ec4b156629a354fb8f261aa3d9bc3b4

        SHA256

        8296b847f9aaef1ebc0296cf83c1db5b29d17aced1335ee16968d332cbf4854a

        SHA512

        901e9bd28afef9378aa764068281544efe941597bd1f86b6b8f7903e069092489012f86bc7d60cc41ac9276458ced49f6ad04505b791d73ee7080a30d1aaecf5

      • memory/1420-52-0x0000000074C00000-0x0000000074D7B000-memory.dmp

        Filesize

        1.5MB

      • memory/1420-48-0x00007FFB3E410000-0x00007FFB3E605000-memory.dmp

        Filesize

        2.0MB

      • memory/1420-54-0x0000000074C00000-0x0000000074D7B000-memory.dmp

        Filesize

        1.5MB

      • memory/1420-51-0x0000000074C00000-0x0000000074D7B000-memory.dmp

        Filesize

        1.5MB

      • memory/2160-42-0x000000005A2B0000-0x000000005A3D2000-memory.dmp

        Filesize

        1.1MB

      • memory/2160-34-0x00007FFB204A0000-0x00007FFB20612000-memory.dmp

        Filesize

        1.4MB

      • memory/2160-45-0x000000005A280000-0x000000005A2A9000-memory.dmp

        Filesize

        164KB

      • memory/2160-35-0x00007FFB204A0000-0x00007FFB20612000-memory.dmp

        Filesize

        1.4MB

      • memory/2160-41-0x000000005A3E0000-0x000000005A3F6000-memory.dmp

        Filesize

        88KB

      • memory/2160-39-0x00007FFB204A0000-0x00007FFB20612000-memory.dmp

        Filesize

        1.4MB

      • memory/4772-37-0x0000000074720000-0x000000007489B000-memory.dmp

        Filesize

        1.5MB

      • memory/4772-13-0x0000000074720000-0x000000007489B000-memory.dmp

        Filesize

        1.5MB

      • memory/4772-0-0x0000000000400000-0x000000000058C000-memory.dmp

        Filesize

        1.5MB

      • memory/4772-2-0x0000000074720000-0x000000007489B000-memory.dmp

        Filesize

        1.5MB

      • memory/5044-55-0x00007FFB3E410000-0x00007FFB3E605000-memory.dmp

        Filesize

        2.0MB

      • memory/5044-56-0x0000000000A00000-0x0000000000A67000-memory.dmp

        Filesize

        412KB

      • memory/5044-59-0x0000000000A00000-0x0000000000A67000-memory.dmp

        Filesize

        412KB

      • memory/5044-60-0x00000000000A0000-0x00000000004D3000-memory.dmp

        Filesize

        4.2MB

      • memory/5044-61-0x0000000061E00000-0x0000000061EF3000-memory.dmp

        Filesize

        972KB

      • memory/5044-102-0x0000000000A00000-0x0000000000A67000-memory.dmp

        Filesize

        412KB