Analysis
-
max time kernel
98s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20231201-en -
resource tags
arch:x64arch:x86image:win10v2004-20231201-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2023 09:27
Static task
static1
Behavioral task
behavioral1
Sample
34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe
Resource
win10v2004-20231201-en
General
-
Target
34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe
-
Size
11.3MB
-
MD5
98a0bf4af1e1e9a69bddee4421e1772d
-
SHA1
38c9160650423557c000b624dc5764c7e593b6e2
-
SHA256
34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa
-
SHA512
57e5311bc68b22f59029129ed8a11b6e604e908eba60bc4548604011eee2465ffee5748157d78377c796bb6a2e019cd9018f84f4fc610a45255ee4729f1797dc
-
SSDEEP
196608:Z0OHLe9/L+y5ugST2ZHZIXt/D7awIyOmAJuA4PZPc2iVXLy0LY7tvRo:K39/Cy5ugPnIFb37AJ+Nc2ikQGo
Malware Config
Extracted
vidar
6.5
ff0f5173b378c3dde7c3c6e3ae14c3a6
https://t.me/starcofeeth
https://steamcommunity.com/profiles/76561199571056594
-
profile_id_v2
ff0f5173b378c3dde7c3c6e3ae14c3a6
-
user_agent
Mozilla/5.0 (X11; CrOS x86_64 15329.59.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exedescription pid process target process PID 1544 set thread context of 3580 1544 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4772 3580 WerFault.exe 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exedescription pid process target process PID 1544 wrote to memory of 3580 1544 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe PID 1544 wrote to memory of 3580 1544 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe PID 1544 wrote to memory of 3580 1544 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe PID 1544 wrote to memory of 3580 1544 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe PID 1544 wrote to memory of 3580 1544 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe PID 1544 wrote to memory of 3580 1544 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe PID 1544 wrote to memory of 3580 1544 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe PID 1544 wrote to memory of 3580 1544 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe PID 1544 wrote to memory of 3580 1544 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe"C:\Users\Admin\AppData\Local\Temp\34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe"C:\Users\Admin\AppData\Local\Temp\34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 3883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3580 -ip 35801⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1544-0-0x0000000074940000-0x00000000750F0000-memory.dmpFilesize
7.7MB
-
memory/1544-1-0x0000000000670000-0x00000000011BE000-memory.dmpFilesize
11.3MB
-
memory/1544-2-0x0000000006120000-0x00000000066C4000-memory.dmpFilesize
5.6MB
-
memory/1544-3-0x00000000034F0000-0x0000000003500000-memory.dmpFilesize
64KB
-
memory/1544-8-0x0000000074940000-0x00000000750F0000-memory.dmpFilesize
7.7MB
-
memory/3580-4-0x0000000001300000-0x0000000001539000-memory.dmpFilesize
2.2MB
-
memory/3580-7-0x0000000001300000-0x0000000001539000-memory.dmpFilesize
2.2MB
-
memory/3580-10-0x0000000001300000-0x0000000001539000-memory.dmpFilesize
2.2MB