Analysis
-
max time kernel
161s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2023 12:23
Static task
static1
Behavioral task
behavioral1
Sample
8bcefafd38c46bedef87a84356e77b06.exe
Resource
win7-20231215-en
General
-
Target
8bcefafd38c46bedef87a84356e77b06.exe
-
Size
670KB
-
MD5
8bcefafd38c46bedef87a84356e77b06
-
SHA1
a6cc5deacdc204198bb1e22a8915420c32006f25
-
SHA256
de3bc3bc66f1567261e1b456ec97dec031e4041ed80ce7c7d484592c8001ac1c
-
SHA512
28d707105b3ef3f4a00814252632bfa646302bb47179bde3c1794fb6ce7fcb143e44df712daa620dada5df03159339bebf3a5f824f90fff0868ca4b7c4fc0336
-
SSDEEP
12288:aEGLpQW3wNNYp8iHzrF7FVpXu9cMoE7zR0ywfPrk/Lwx/0ZxoN2UN0akHkTaHCEo:aEk7AnurFRVVuJNXiyEHxYeNUakTHCox
Malware Config
Extracted
vidar
40.5
706
https://gheorghip.tumblr.com/
-
profile_id
706
Signatures
-
Vidar Stealer 7 IoCs
Processes:
resource yara_rule behavioral2/memory/4044-2-0x00000000047F0000-0x00000000048C1000-memory.dmp family_vidar behavioral2/memory/4044-3-0x0000000000400000-0x0000000002BB2000-memory.dmp family_vidar behavioral2/memory/4044-4-0x0000000000400000-0x0000000002BB2000-memory.dmp family_vidar behavioral2/memory/4044-18-0x0000000000400000-0x0000000002BB2000-memory.dmp family_vidar behavioral2/memory/4044-25-0x00000000047F0000-0x00000000048C1000-memory.dmp family_vidar behavioral2/memory/4044-63-0x0000000000400000-0x0000000002BB2000-memory.dmp family_vidar behavioral2/memory/4044-74-0x0000000000400000-0x0000000002BB2000-memory.dmp family_vidar -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1116 4044 WerFault.exe 8bcefafd38c46bedef87a84356e77b06.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
8bcefafd38c46bedef87a84356e77b06.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 8bcefafd38c46bedef87a84356e77b06.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 8bcefafd38c46bedef87a84356e77b06.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
8bcefafd38c46bedef87a84356e77b06.exepid process 4044 8bcefafd38c46bedef87a84356e77b06.exe 4044 8bcefafd38c46bedef87a84356e77b06.exe 4044 8bcefafd38c46bedef87a84356e77b06.exe 4044 8bcefafd38c46bedef87a84356e77b06.exe 4044 8bcefafd38c46bedef87a84356e77b06.exe 4044 8bcefafd38c46bedef87a84356e77b06.exe 4044 8bcefafd38c46bedef87a84356e77b06.exe 4044 8bcefafd38c46bedef87a84356e77b06.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bcefafd38c46bedef87a84356e77b06.exe"C:\Users\Admin\AppData\Local\Temp\8bcefafd38c46bedef87a84356e77b06.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 16162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4044 -ip 40441⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\softokn3.dllFilesize
119KB
MD5e84b1afdf3f7caddc53f6dd779386a0d
SHA1f8153c9fe6748100e7061872f3d6b67e9542142f
SHA2568590144c985a09c70e14e510a11336e05fd87bef3f7e6f8f448eeb02b1b03485
SHA5120340c606d3e862268e17fe9fa122d393eac564fad022026d25df1aa5a34b534ea7e5c96f2ec860fc811a037b4a96469a5507ad227666c430eb70e57ec5415b77
-
memory/4044-1-0x0000000002C80000-0x0000000002D80000-memory.dmpFilesize
1024KB
-
memory/4044-2-0x00000000047F0000-0x00000000048C1000-memory.dmpFilesize
836KB
-
memory/4044-3-0x0000000000400000-0x0000000002BB2000-memory.dmpFilesize
39.7MB
-
memory/4044-4-0x0000000000400000-0x0000000002BB2000-memory.dmpFilesize
39.7MB
-
memory/4044-18-0x0000000000400000-0x0000000002BB2000-memory.dmpFilesize
39.7MB
-
memory/4044-23-0x0000000002C80000-0x0000000002D80000-memory.dmpFilesize
1024KB
-
memory/4044-25-0x00000000047F0000-0x00000000048C1000-memory.dmpFilesize
836KB
-
memory/4044-63-0x0000000000400000-0x0000000002BB2000-memory.dmpFilesize
39.7MB
-
memory/4044-74-0x0000000000400000-0x0000000002BB2000-memory.dmpFilesize
39.7MB