Analysis
-
max time kernel
0s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
07-01-2024 19:47
General
-
Target
bfdb06e19260107f468834d5601f7f295ca82b31966be48f856011d9dba1f5b7exe.exe
-
Size
2.5MB
-
MD5
66d13537ed49e50fb83673f7632c0e5e
-
SHA1
dc3ac1f47fe9d06e847fcb0ddf26190add45b839
-
SHA256
bfdb06e19260107f468834d5601f7f295ca82b31966be48f856011d9dba1f5b7
-
SHA512
c7047b62d3d8313bd9eec725c310a635f452e57d21b5ae625ef7993620ffc7fbb503ac3dc5b9309fdf47704437a4126d35155f63697761888c36d399baca1064
-
SSDEEP
49152:9gFBlMFeWIvkLRoj9xuL5daZ1MzvgQza2Mv14mkE2NHGBF2E8r1TAHzNxy8zX5FT:y3lMTrLujc5wjMzlzbAhr2hGAE8RsHHr
Malware Config
Extracted
vidar
40.4
706
https://romkaxarit.tumblr.com/
-
profile_id
706
Extracted
smokeloader
2020
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Extracted
gozi
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar Stealer 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Program crash 3 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfdb06e19260107f468834d5601f7f295ca82b31966be48f856011d9dba1f5b7exe.exe"C:\Users\Admin\AppData\Local\Temp\bfdb06e19260107f468834d5601f7f295ca82b31966be48f856011d9dba1f5b7exe.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\7zS44BD0226\Fri12e21d8598.exe"C:\Users\Admin\AppData\Local\Temp\7zS44BD0226\Fri12e21d8598.exe" -u1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 5882⤵
- Loads dropped DLL
- Program crash
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\7zS44BD0226\Fri1229966ae2.exeFri1229966ae2.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS44BD0226\Fri1217d16cb7f3924a2.exeFri1217d16cb7f3924a2.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 9682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 4161⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\7zS44BD0226\Fri12c29e55e121906.exeFri12c29e55e121906.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS44BD0226\Fri12716cec7fe.exeFri12716cec7fe.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS44BD0226\Fri1269b50f53f6d35.exeFri1269b50f53f6d35.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS44BD0226\Fri12a1855208d3.exeFri12a1855208d3.exe1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS44BD0226\Fri12e21d8598.exeFri12e21d8598.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri1229966ae2.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri12716cec7fe.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri12e21d8598.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri1269b50f53f6d35.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri12c29e55e121906.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri1217d16cb7f3924a2.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri12a1855208d3.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS44BD0226\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS44BD0226\setup_install.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7955.exeC:\Users\Admin\AppData\Local\Temp\7955.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\3om7yoas33w_1.exe/suac3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\847C.exeC:\Users\Admin\AppData\Local\Temp\847C.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD53687df3d6547990a375ee04313a48650
SHA18b40134f4df42a7be96020f94edd9be4cb9fc7c3
SHA2560f994aac5303619ced726f3917b506d4cb045c2a526f7d3d7b81b1c062e1e3c6
SHA512bc11d36e4df28d789a34048d7caf6b59f31cd9ec3a35435523df6f5c9278967d083cc1c300db63624a2ebfb6b10164c7f2ac602841b73448ec69bdff1186e5cb
-
Filesize
894KB
MD5710533a75aea5da3054bff80bdeb099e
SHA10a1974ed0e2a306108813d2faa554472c261713d
SHA256ef1694bf0979ba7cb27a662412461be858515c3d578dc11407cb8e04d2534642
SHA512eff868d5c9f3f9b2424e63b7f14bdd9b1335c54e5813df288c9da76610fa774d888ef6a2a05d47b37c4e1859318dd31e0a1212dc31bfaddff2c4cf1fb3161b6a
-
Filesize
2.4MB
MD5a8224c924e89e0433123d5b837167ad2
SHA168a3e27c33df0edab5f1c4c8f48b06e162033b11
SHA256ff8ea01cceb39bcdd35ef51670129f01f3ec5f5b3c1d52e4ca9ce201b6e8d372
SHA512f3e2052544dc4381f70c96db8a94eac0aef52f089bb304825180d7b7fb0e89264518f85b6982bc1a3e48fc20288e5c51bf351142d986217e62523f9f564319fa
-
Filesize
381KB
MD5a275eb35a2f3dde8848eef51c9831413
SHA102fca212bab8836de31fbad45f6f2b4520cd2c3e
SHA2560b3ebb93d16d3d44508a56495c429003df7cd8a663a845ef623401ed42b4a883
SHA512b89f0baa68df6fe55570f0b1ba4c5811cf52784452d9d5f2878a97e25cd4968ccf234cf193d1770ed22ef916f5bb62f34d18cafaef2cf8b1c4b53843d3c99441
-
Filesize
92KB
MD5305c00c540e5c010533765562d65c13e
SHA1aacc016e7852e78e73a26cc19e6aca30b4a1161a
SHA256bf1a789cc4befb3927cf39258e6111b2bbb8720b8e8d811daefdcd6a45500b4a
SHA512b1b86d6d8d62f8f7a9c12902da86ba54a651094360101810f6fb68937531caed8ac09973462cc9f20f0381da1b634049fb6ca0f6c5b74b57fae2c74bece7867a
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
6.8MB
-
Filesize
1024KB
-
Filesize
29.8MB
-
Filesize
844KB
-
Filesize
784KB
-
Filesize
1024KB
-
Filesize
29.8MB
-
Filesize
844KB
-
Filesize
6.8MB
-
Filesize
84KB
-
Filesize
24KB
-
Filesize
4KB
-
Filesize
6.8MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
24KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
1.5MB
-
Filesize
784KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
48KB
-
Filesize
784KB
-
Filesize
1.5MB
-
Filesize
24KB
-
Filesize
784KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
176KB
-
Filesize
9.9MB
-
Filesize
128KB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
436KB
-
Filesize
784KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
1.7MB
-
Filesize
9.9MB
-
Filesize
32KB
-
Filesize
1024KB
-
Filesize
29.3MB
-
Filesize
36KB
-
Filesize
29.3MB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
100KB
-
Filesize
1.5MB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
152KB
-
Filesize
784KB
-
Filesize
140KB
-
Filesize
100KB
-
Filesize
152KB
-
Filesize
1.1MB
-
Filesize
572KB
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
52KB
-
Filesize
408KB
-
Filesize
48KB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
24KB
-
Filesize
372KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
784KB