Analysis

  • max time kernel
    84s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 20:40

General

  • Target

    LauncherPC_S0FT/Set-up.exe

  • Size

    597.9MB

  • MD5

    8a30291c653f6b3c4f7c7c04df07ff49

  • SHA1

    ba241086d27312c723750b79a37f339874007dba

  • SHA256

    2402aa5e5f77a7e485c31c134770b9ff4be70c9038b634f745694d6cd02a01d1

  • SHA512

    1f67a07fe479b35782e65d431777d201471fd6e3ac0849e673932f789d7bcde1e69b19a2e4b7a4f1047fe732648f80e9218d256068de8e0fe7f1c9a8290866c0

  • SSDEEP

    393216:dpZbJIRQSoVL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eLT:dSiSG

Malware Config

Extracted

Family

vidar

C2

http://5.182.86.94:80

https://t.me/vookihhfds

https://t.me/secgoxrp

https://steamcommunity.com/profiles/76561199568528949

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:110.0) Gecko/20100101 Firefox/121.0

Signatures

  • Detect Vidar Stealer 3 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe
    "C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe"
    1⤵
    • Checks computer location settings
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4564
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe" & del "C:\ProgramData\*.dll"" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4956
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • Delays execution with timeout.exe
        PID:3600

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4564-0-0x0000000000F70000-0x00000000019BD000-memory.dmp

          Filesize

          10.3MB

        • memory/4564-2-0x0000000000C80000-0x0000000000C81000-memory.dmp

          Filesize

          4KB

        • memory/4564-1-0x0000000000B50000-0x0000000000B51000-memory.dmp

          Filesize

          4KB

        • memory/4564-4-0x0000000000F70000-0x00000000019BD000-memory.dmp

          Filesize

          10.3MB

        • memory/4564-5-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

          Filesize

          4KB

        • memory/4564-3-0x0000000000C90000-0x0000000000C91000-memory.dmp

          Filesize

          4KB

        • memory/4564-6-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

          Filesize

          4KB

        • memory/4564-7-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

          Filesize

          4KB

        • memory/4564-8-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

          Filesize

          4KB

        • memory/4564-9-0x0000000000F70000-0x00000000019BD000-memory.dmp

          Filesize

          10.3MB

        • memory/4564-11-0x0000000010000000-0x000000001025F000-memory.dmp

          Filesize

          2.4MB

        • memory/4564-18-0x0000000000F70000-0x00000000019BD000-memory.dmp

          Filesize

          10.3MB