Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    04-01-2024 02:54

General

  • Target

    3fb54645fba660ad5c6824ccff364832.exe

  • Size

    543KB

  • MD5

    3fb54645fba660ad5c6824ccff364832

  • SHA1

    107f0844fc867bda1b7f664421c92712bc2a9a5b

  • SHA256

    de05db338a5854f13a46e498a6ba4484b7bd47062ed3adae9a93bb8cc767d3d9

  • SHA512

    ae80fe134835548a3684a2f68248a2e55a9a1db096e0a014a8fd56173141b8a11b6f07ec982f4b096436250b9ff22edf8c9d7f6439a07ce3e8f9735a94abf339

  • SSDEEP

    12288:F1Gt75Q2a/P457JGNor4kLNpJDg8RFdn5nHhhTUUmviVn0woO:k75a/PIdGiLNvJRZhFhgiE

Malware Config

Extracted

Family

vidar

Version

39.9

Botnet

706

C2

https://prophefliloc.tumblr.com/

Attributes
  • profile_id

    706

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 5 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3fb54645fba660ad5c6824ccff364832.exe
    "C:\Users\Admin\AppData\Local\Temp\3fb54645fba660ad5c6824ccff364832.exe"
    1⤵
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2968
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im 3fb54645fba660ad5c6824ccff364832.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\3fb54645fba660ad5c6824ccff364832.exe" & del C:\ProgramData\*.dll & exit
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:652
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im 3fb54645fba660ad5c6824ccff364832.exe /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:588
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 6
        3⤵
        • Delays execution with timeout.exe
        PID:2092

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\freebl3.dll

    Filesize

    209B

    MD5

    400f4a9df16c57408a470f8824d1b0db

    SHA1

    1c4303b161495e1ac9e8b45dc17d48ec8ef32ed0

    SHA256

    a2ead324e8fb1bf569d026d0976f83d2bf9d2162151ddc8ef0d5a58ccc5e168c

    SHA512

    a91f8f813d09621541f85f87ce9069f3da3e871d6c69255a023d7dca8f7a8b0e4aca51929837c5a3d3656a84f12285530d3f56cbcb01d09a94a420469bf308ba

  • C:\ProgramData\mozglue.dll

    Filesize

    209B

    MD5

    5d21ca36b78ecb220e2548020bc15ed7

    SHA1

    d4103638ab888429cdb7fd86d19f5778892352ac

    SHA256

    023c3490c339e79524933c9f6f09c9882c2f8f9a4093ceeb8ec08c4e25f7ab2e

    SHA512

    a256b73741b3103d8f7938bcd7222c98f29d6d040df9795a10143c4aa1cced388dd343b2221b4aab2a30bda8b60db342aa1d6bac0db685107cba1bdd96595ced

  • C:\ProgramData\msvcp140.dll

    Filesize

    210B

    MD5

    fa4fb3509396425b35c3bd4a11aca709

    SHA1

    f69e03b83b5a714de42a727b3fa97dfe725193ae

    SHA256

    8eb400d985182a0458c0518cba4b4d9eff1fb9904acadcbb6c8a8d0567c69393

    SHA512

    c23c7e848be36cad5c041c170bd1402c9907ed2c9818cc19d9124bb4b95da96b70419da05b3d94375d45896b7cf5beb06fe6ea823495e4d93877b16f1c4f54ae

  • C:\ProgramData\nss3.dll

    Filesize

    206B

    MD5

    81fd90a928ef821dfadc577370c2523c

    SHA1

    06e88b20550f1e65077025ba1cde98528751bc13

    SHA256

    79828ce5c456dd06feb743bf1f452c61ef800a52112cda3ce16f67cb25dbb1d8

    SHA512

    cb989ecf19563594bc74b6898e621897f2a197e292fb6d99a1e411bbe649e8481bcc47af0b7a5c9625549fa8d99bf1250d72033ccdf41d4207bad0928f75c673

  • C:\ProgramData\softokn3.dll

    Filesize

    210B

    MD5

    fd5d75c4ab3ba343a378324d9b05bbff

    SHA1

    9b31507eee93eb2e6fee07889f008f9668d14dd3

    SHA256

    63365e7603f9cac52ff6ccc52a83436cf8073a6a97491fd3c5a2ccc52088b7dd

    SHA512

    81e59c3670b7f4bc2eb60e1966607a57dfabb891d667c9bde57c5ab6d4c84d7358af5ae55fdac7555e147d6d228358639be735e792f59d1d776a4ffa053bdc5d

  • C:\ProgramData\vcruntime140.dll

    Filesize

    214B

    MD5

    f87daed56fdfea78c2ed2566f440bada

    SHA1

    db707626249bbd4424fe896c29cb207136f096a7

    SHA256

    3896a4c4b6796f244b4c038a504f07455dd482f6f778c6355fa73e50fb541cb8

    SHA512

    3c6dbf313a2d5894fec53b9ed99cbad648a9897f00434ed24c2f60e34142e480c6593c40859905e892e581d9834f3d186400f58c05de40b5ac60488c3ce9a395

  • C:\Users\Admin\AppData\Local\Temp\CabAAD2.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\TarAB71.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • memory/2968-81-0x0000000002D90000-0x0000000002E90000-memory.dmp

    Filesize

    1024KB

  • memory/2968-82-0x0000000000300000-0x000000000039D000-memory.dmp

    Filesize

    628KB

  • memory/2968-80-0x0000000000400000-0x0000000002CBF000-memory.dmp

    Filesize

    40.7MB

  • memory/2968-63-0x0000000000400000-0x0000000002CBF000-memory.dmp

    Filesize

    40.7MB

  • memory/2968-1-0x0000000002D90000-0x0000000002E90000-memory.dmp

    Filesize

    1024KB

  • memory/2968-3-0x0000000000400000-0x0000000002CBF000-memory.dmp

    Filesize

    40.7MB

  • memory/2968-2-0x0000000000300000-0x000000000039D000-memory.dmp

    Filesize

    628KB