Analysis
-
max time kernel
34s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/02/2024, 20:40
Static task
static1
Behavioral task
behavioral1
Sample
LauncherPC_S0FT/Set-up.exe
Resource
win7-20240221-en
General
-
Target
LauncherPC_S0FT/Set-up.exe
-
Size
597.9MB
-
MD5
8a30291c653f6b3c4f7c7c04df07ff49
-
SHA1
ba241086d27312c723750b79a37f339874007dba
-
SHA256
2402aa5e5f77a7e485c31c134770b9ff4be70c9038b634f745694d6cd02a01d1
-
SHA512
1f67a07fe479b35782e65d431777d201471fd6e3ac0849e673932f789d7bcde1e69b19a2e4b7a4f1047fe732648f80e9218d256068de8e0fe7f1c9a8290866c0
-
SSDEEP
393216:dpZbJIRQSoVL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eLT:dSiSG
Malware Config
Extracted
vidar
http://5.182.86.94:80
https://t.me/vookihhfds
https://t.me/secgoxrp
https://steamcommunity.com/profiles/76561199568528949
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:110.0) Gecko/20100101 Firefox/121.0
Signatures
-
Detect Vidar Stealer 2 IoCs
resource yara_rule behavioral1/memory/2880-3-0x0000000000950000-0x000000000139D000-memory.dmp family_vidar_v7 behavioral1/memory/2880-47-0x0000000000950000-0x000000000139D000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Deletes itself 1 IoCs
pid Process 2356 cmd.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Set-up.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Set-up.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1872 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2880 Set-up.exe 2880 Set-up.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2880 wrote to memory of 2520 2880 Set-up.exe 30 PID 2880 wrote to memory of 2520 2880 Set-up.exe 30 PID 2880 wrote to memory of 2520 2880 Set-up.exe 30 PID 2880 wrote to memory of 2520 2880 Set-up.exe 30 PID 2880 wrote to memory of 2356 2880 Set-up.exe 31 PID 2880 wrote to memory of 2356 2880 Set-up.exe 31 PID 2880 wrote to memory of 2356 2880 Set-up.exe 31 PID 2880 wrote to memory of 2356 2880 Set-up.exe 31 PID 2356 wrote to memory of 1872 2356 cmd.exe 34 PID 2356 wrote to memory of 1872 2356 cmd.exe 34 PID 2356 wrote to memory of 1872 2356 cmd.exe 34 PID 2356 wrote to memory of 1872 2356 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe"C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\EBAAAFBGDB.exe"2⤵PID:2520
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe" & del "C:\ProgramData\*.dll"" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:1872
-
-