Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2023 03:03
Static task
static1
Behavioral task
behavioral1
Sample
586126f4151fea05665e55f7f0e6a74f.exe
Resource
win7-20231215-en
General
-
Target
586126f4151fea05665e55f7f0e6a74f.exe
-
Size
671KB
-
MD5
586126f4151fea05665e55f7f0e6a74f
-
SHA1
8f4917dcb9a9f7529da225a5bc70a817572cc461
-
SHA256
279c60038d0b7b97c130d2913e501eca3c8ec4b78ed799059a8e3ba3a18d1dc7
-
SHA512
e4dfae3428b37c7fe102ff57b91906a1f44eb31ec77878d88cd6bb77da0e1b79201b919f137112a88182bf6383e130d27307547bff86cc4b0d1f8a51c9eced3c
-
SSDEEP
12288:Uzilc1OGRFsQixZp7AsZhaKZyn0+PTi96i97LzY9PoPoHe3Dmdpg:UI0vBi17vZdyn0gOs47wUo8Dmdp
Malware Config
Extracted
vidar
40.5
706
https://gheorghip.tumblr.com/
-
profile_id
706
Signatures
-
Vidar Stealer 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4704-2-0x0000000004910000-0x00000000049E1000-memory.dmp family_vidar behavioral2/memory/4704-3-0x0000000000400000-0x0000000002BB2000-memory.dmp family_vidar behavioral2/memory/4704-18-0x0000000000400000-0x0000000002BB2000-memory.dmp family_vidar behavioral2/memory/4704-70-0x0000000000400000-0x0000000002BB2000-memory.dmp family_vidar behavioral2/memory/4704-72-0x0000000004910000-0x00000000049E1000-memory.dmp family_vidar -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4108 4704 WerFault.exe 586126f4151fea05665e55f7f0e6a74f.exe 1392 4704 WerFault.exe 586126f4151fea05665e55f7f0e6a74f.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
586126f4151fea05665e55f7f0e6a74f.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 586126f4151fea05665e55f7f0e6a74f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 586126f4151fea05665e55f7f0e6a74f.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
586126f4151fea05665e55f7f0e6a74f.exepid process 4704 586126f4151fea05665e55f7f0e6a74f.exe 4704 586126f4151fea05665e55f7f0e6a74f.exe 4704 586126f4151fea05665e55f7f0e6a74f.exe 4704 586126f4151fea05665e55f7f0e6a74f.exe 4704 586126f4151fea05665e55f7f0e6a74f.exe 4704 586126f4151fea05665e55f7f0e6a74f.exe 4704 586126f4151fea05665e55f7f0e6a74f.exe 4704 586126f4151fea05665e55f7f0e6a74f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\586126f4151fea05665e55f7f0e6a74f.exe"C:\Users\Admin\AppData\Local\Temp\586126f4151fea05665e55f7f0e6a74f.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 18202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 17722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4704 -ip 47041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4704 -ip 47041⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\softokn3.dllFilesize
119KB
MD5ee7e5e4f8d0fa7c55baa75c6986cf75c
SHA10ceeea974dc81cbd3f1a62169681225f1f3d773a
SHA256d2715b807a61cfcce6eb6fbac524a46ae81f41b66ad05ca344ae7844ff4669c7
SHA512fe2b869921523c19bb187605498bc4fe2d5cc29df91d90745b247960d83bff292be0aa9c1651eea4f8b88606d6949ff76ca4c7666de02b3eb01cd3640956526f
-
memory/4704-1-0x0000000002CF0000-0x0000000002DF0000-memory.dmpFilesize
1024KB
-
memory/4704-2-0x0000000004910000-0x00000000049E1000-memory.dmpFilesize
836KB
-
memory/4704-3-0x0000000000400000-0x0000000002BB2000-memory.dmpFilesize
39.7MB
-
memory/4704-18-0x0000000000400000-0x0000000002BB2000-memory.dmpFilesize
39.7MB
-
memory/4704-70-0x0000000000400000-0x0000000002BB2000-memory.dmpFilesize
39.7MB
-
memory/4704-71-0x0000000002CF0000-0x0000000002DF0000-memory.dmpFilesize
1024KB
-
memory/4704-72-0x0000000004910000-0x00000000049E1000-memory.dmpFilesize
836KB