Analysis
-
max time kernel
68s -
max time network
73s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/02/2024, 20:48
Static task
static1
Behavioral task
behavioral1
Sample
LauncherPC_S0FT/Set-up.exe
Resource
win7-20240221-en
General
-
Target
LauncherPC_S0FT/Set-up.exe
-
Size
783.8MB
-
MD5
fbe8ed195bd48fb454336c7b17e524d3
-
SHA1
e11fee2e8965482450c4e6b7a44bf45492c3708d
-
SHA256
0521cd6d3cc340abfe9f340b91987d840baddf8846d61a5a7d350d1968272b83
-
SHA512
fd981a653447a5023a3cae15327fc0a4737cda12dcce25e638caf9e54a387578ecb4955eefc331a58b6f9da11188bb1bacddf252c9b0ba636389226dfda01ffa
-
SSDEEP
393216:dpZbJIRQSoVL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eLq:dSiSv
Malware Config
Extracted
vidar
http://5.182.86.94:80
https://t.me/vookihhfds
https://t.me/secgoxrp
https://steamcommunity.com/profiles/76561199568528949
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:110.0) Gecko/20100101 Firefox/121.0
Signatures
-
Detect Vidar Stealer 3 IoCs
resource yara_rule behavioral1/memory/2768-3-0x0000000000E50000-0x000000000189D000-memory.dmp family_vidar_v7 behavioral1/memory/2768-38-0x0000000000E50000-0x000000000189D000-memory.dmp family_vidar_v7 behavioral1/memory/2768-48-0x0000000000E50000-0x000000000189D000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Deletes itself 1 IoCs
pid Process 2408 cmd.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Set-up.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Set-up.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1856 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2768 Set-up.exe 2768 Set-up.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2768 wrote to memory of 2192 2768 Set-up.exe 32 PID 2768 wrote to memory of 2192 2768 Set-up.exe 32 PID 2768 wrote to memory of 2192 2768 Set-up.exe 32 PID 2768 wrote to memory of 2192 2768 Set-up.exe 32 PID 2768 wrote to memory of 2408 2768 Set-up.exe 34 PID 2768 wrote to memory of 2408 2768 Set-up.exe 34 PID 2768 wrote to memory of 2408 2768 Set-up.exe 34 PID 2768 wrote to memory of 2408 2768 Set-up.exe 34 PID 2408 wrote to memory of 1856 2408 cmd.exe 36 PID 2408 wrote to memory of 1856 2408 cmd.exe 36 PID 2408 wrote to memory of 1856 2408 cmd.exe 36 PID 2408 wrote to memory of 1856 2408 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe"C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\KKJJEBFCGD.exe"2⤵PID:2192
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe" & del "C:\ProgramData\*.dll"" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:1856
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1460