Analysis
-
max time kernel
84s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/02/2024, 20:40
Static task
static1
Behavioral task
behavioral1
Sample
LauncherPC_S0FT/Set-up.exe
Resource
win7-20240221-en
General
-
Target
LauncherPC_S0FT/Set-up.exe
-
Size
597.9MB
-
MD5
8a30291c653f6b3c4f7c7c04df07ff49
-
SHA1
ba241086d27312c723750b79a37f339874007dba
-
SHA256
2402aa5e5f77a7e485c31c134770b9ff4be70c9038b634f745694d6cd02a01d1
-
SHA512
1f67a07fe479b35782e65d431777d201471fd6e3ac0849e673932f789d7bcde1e69b19a2e4b7a4f1047fe732648f80e9218d256068de8e0fe7f1c9a8290866c0
-
SSDEEP
393216:dpZbJIRQSoVL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eLT:dSiSG
Malware Config
Extracted
vidar
http://5.182.86.94:80
https://t.me/vookihhfds
https://t.me/secgoxrp
https://steamcommunity.com/profiles/76561199568528949
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:110.0) Gecko/20100101 Firefox/121.0
Signatures
-
Detect Vidar Stealer 3 IoCs
resource yara_rule behavioral2/memory/4564-4-0x0000000000F70000-0x00000000019BD000-memory.dmp family_vidar_v7 behavioral2/memory/4564-9-0x0000000000F70000-0x00000000019BD000-memory.dmp family_vidar_v7 behavioral2/memory/4564-18-0x0000000000F70000-0x00000000019BD000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation Set-up.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Set-up.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Set-up.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3600 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4564 Set-up.exe 4564 Set-up.exe 4564 Set-up.exe 4564 Set-up.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4564 wrote to memory of 4956 4564 Set-up.exe 85 PID 4564 wrote to memory of 4956 4564 Set-up.exe 85 PID 4564 wrote to memory of 4956 4564 Set-up.exe 85 PID 4956 wrote to memory of 3600 4956 cmd.exe 87 PID 4956 wrote to memory of 3600 4956 cmd.exe 87 PID 4956 wrote to memory of 3600 4956 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe"C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe"1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe" & del "C:\ProgramData\*.dll"" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:3600
-
-