Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2023 14:54
Static task
static1
Behavioral task
behavioral1
Sample
cec96441b7aec3a25e12fb162f97dc95.exe
Resource
win7-20231215-en
General
-
Target
cec96441b7aec3a25e12fb162f97dc95.exe
-
Size
694KB
-
MD5
cec96441b7aec3a25e12fb162f97dc95
-
SHA1
180e9f1be05cc240f518d8434cfba0b996529967
-
SHA256
a31c163b94090364e2943cfb908a19964d35f429618c5b2a5bc2acfc4b6485cf
-
SHA512
0336e4de1dc8ccba6e07e5ca89b9ff265cb94f0541103d3ed34b3867f57911ea4dcbae954dd679e39c04e08dcf31b33c1899a85f6b2e09e32cb91f0fbfa84aa5
-
SSDEEP
12288:4UsXWCVB5WibBe6d4gnVM4QOEu4z9WhQZs7cIYpckrz85lx7ldXARUI9nk:4UYvwb6d434QTu4Js530wtTIUgn
Malware Config
Extracted
vidar
40.5
706
https://gheorghip.tumblr.com/
-
profile_id
706
Signatures
-
Vidar Stealer 5 IoCs
Processes:
resource yara_rule behavioral2/memory/376-2-0x0000000004990000-0x0000000004A61000-memory.dmp family_vidar behavioral2/memory/376-3-0x0000000000400000-0x0000000002BB8000-memory.dmp family_vidar behavioral2/memory/376-22-0x0000000000400000-0x0000000002BB8000-memory.dmp family_vidar behavioral2/memory/376-70-0x0000000000400000-0x0000000002BB8000-memory.dmp family_vidar behavioral2/memory/376-72-0x0000000004990000-0x0000000004A61000-memory.dmp family_vidar -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2540 376 WerFault.exe cec96441b7aec3a25e12fb162f97dc95.exe 3168 376 WerFault.exe cec96441b7aec3a25e12fb162f97dc95.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
cec96441b7aec3a25e12fb162f97dc95.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 cec96441b7aec3a25e12fb162f97dc95.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString cec96441b7aec3a25e12fb162f97dc95.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
cec96441b7aec3a25e12fb162f97dc95.exepid process 376 cec96441b7aec3a25e12fb162f97dc95.exe 376 cec96441b7aec3a25e12fb162f97dc95.exe 376 cec96441b7aec3a25e12fb162f97dc95.exe 376 cec96441b7aec3a25e12fb162f97dc95.exe 376 cec96441b7aec3a25e12fb162f97dc95.exe 376 cec96441b7aec3a25e12fb162f97dc95.exe 376 cec96441b7aec3a25e12fb162f97dc95.exe 376 cec96441b7aec3a25e12fb162f97dc95.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cec96441b7aec3a25e12fb162f97dc95.exe"C:\Users\Admin\AppData\Local\Temp\cec96441b7aec3a25e12fb162f97dc95.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 18082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 18042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 376 -ip 3761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 376 -ip 3761⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\softokn3.dllFilesize
119KB
MD5e84b1afdf3f7caddc53f6dd779386a0d
SHA1f8153c9fe6748100e7061872f3d6b67e9542142f
SHA2568590144c985a09c70e14e510a11336e05fd87bef3f7e6f8f448eeb02b1b03485
SHA5120340c606d3e862268e17fe9fa122d393eac564fad022026d25df1aa5a34b534ea7e5c96f2ec860fc811a037b4a96469a5507ad227666c430eb70e57ec5415b77
-
memory/376-1-0x0000000002EF0000-0x0000000002FF0000-memory.dmpFilesize
1024KB
-
memory/376-2-0x0000000004990000-0x0000000004A61000-memory.dmpFilesize
836KB
-
memory/376-3-0x0000000000400000-0x0000000002BB8000-memory.dmpFilesize
39.7MB
-
memory/376-22-0x0000000000400000-0x0000000002BB8000-memory.dmpFilesize
39.7MB
-
memory/376-70-0x0000000000400000-0x0000000002BB8000-memory.dmpFilesize
39.7MB
-
memory/376-72-0x0000000004990000-0x0000000004A61000-memory.dmpFilesize
836KB
-
memory/376-71-0x0000000002EF0000-0x0000000002FF0000-memory.dmpFilesize
1024KB