Analysis

  • max time kernel
    34s
  • max time network
    20s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22/02/2024, 20:40

General

  • Target

    LauncherPC_S0FT/Set-up.exe

  • Size

    597.9MB

  • MD5

    8a30291c653f6b3c4f7c7c04df07ff49

  • SHA1

    ba241086d27312c723750b79a37f339874007dba

  • SHA256

    2402aa5e5f77a7e485c31c134770b9ff4be70c9038b634f745694d6cd02a01d1

  • SHA512

    1f67a07fe479b35782e65d431777d201471fd6e3ac0849e673932f789d7bcde1e69b19a2e4b7a4f1047fe732648f80e9218d256068de8e0fe7f1c9a8290866c0

  • SSDEEP

    393216:dpZbJIRQSoVL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eLT:dSiSG

Malware Config

Extracted

Family

vidar

C2

http://5.182.86.94:80

https://t.me/vookihhfds

https://t.me/secgoxrp

https://steamcommunity.com/profiles/76561199568528949

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:110.0) Gecko/20100101 Firefox/121.0

Signatures

  • Detect Vidar Stealer 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Deletes itself 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe
    "C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\EBAAAFBGDB.exe"
      2⤵
        PID:2520
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe" & del "C:\ProgramData\*.dll"" & exit
        2⤵
        • Deletes itself
        • Suspicious use of WriteProcessMemory
        PID:2356
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 5
          3⤵
          • Delays execution with timeout.exe
          PID:1872

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2520-64-0x0000000000520000-0x0000000000521000-memory.dmp

            Filesize

            4KB

          • memory/2880-15-0x00000000000A0000-0x00000000000A1000-memory.dmp

            Filesize

            4KB

          • memory/2880-20-0x0000000000160000-0x0000000000161000-memory.dmp

            Filesize

            4KB

          • memory/2880-4-0x0000000000080000-0x0000000000081000-memory.dmp

            Filesize

            4KB

          • memory/2880-6-0x0000000000080000-0x0000000000081000-memory.dmp

            Filesize

            4KB

          • memory/2880-7-0x0000000000090000-0x0000000000091000-memory.dmp

            Filesize

            4KB

          • memory/2880-11-0x0000000000090000-0x0000000000091000-memory.dmp

            Filesize

            4KB

          • memory/2880-9-0x0000000000090000-0x0000000000091000-memory.dmp

            Filesize

            4KB

          • memory/2880-12-0x00000000000A0000-0x00000000000A1000-memory.dmp

            Filesize

            4KB

          • memory/2880-13-0x00000000775B0000-0x00000000775B1000-memory.dmp

            Filesize

            4KB

          • memory/2880-22-0x0000000000160000-0x0000000000161000-memory.dmp

            Filesize

            4KB

          • memory/2880-3-0x0000000000950000-0x000000000139D000-memory.dmp

            Filesize

            10.3MB

          • memory/2880-17-0x00000000000A0000-0x00000000000A1000-memory.dmp

            Filesize

            4KB

          • memory/2880-0-0x0000000000950000-0x000000000139D000-memory.dmp

            Filesize

            10.3MB

          • memory/2880-25-0x0000000000170000-0x0000000000171000-memory.dmp

            Filesize

            4KB

          • memory/2880-27-0x0000000000170000-0x0000000000171000-memory.dmp

            Filesize

            4KB

          • memory/2880-30-0x0000000000180000-0x0000000000181000-memory.dmp

            Filesize

            4KB

          • memory/2880-32-0x0000000000180000-0x0000000000181000-memory.dmp

            Filesize

            4KB

          • memory/2880-35-0x0000000000190000-0x0000000000191000-memory.dmp

            Filesize

            4KB

          • memory/2880-37-0x0000000000190000-0x0000000000191000-memory.dmp

            Filesize

            4KB

          • memory/2880-40-0x0000000010000000-0x000000001025F000-memory.dmp

            Filesize

            2.4MB

          • memory/2880-47-0x0000000000950000-0x000000000139D000-memory.dmp

            Filesize

            10.3MB

          • memory/2880-1-0x0000000000080000-0x0000000000081000-memory.dmp

            Filesize

            4KB