Analysis
-
max time kernel
137s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/02/2024, 20:48
Static task
static1
Behavioral task
behavioral1
Sample
LauncherPC_S0FT/Set-up.exe
Resource
win7-20240221-en
General
-
Target
LauncherPC_S0FT/Set-up.exe
-
Size
783.8MB
-
MD5
fbe8ed195bd48fb454336c7b17e524d3
-
SHA1
e11fee2e8965482450c4e6b7a44bf45492c3708d
-
SHA256
0521cd6d3cc340abfe9f340b91987d840baddf8846d61a5a7d350d1968272b83
-
SHA512
fd981a653447a5023a3cae15327fc0a4737cda12dcce25e638caf9e54a387578ecb4955eefc331a58b6f9da11188bb1bacddf252c9b0ba636389226dfda01ffa
-
SSDEEP
393216:dpZbJIRQSoVL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eL0eLq:dSiSv
Malware Config
Extracted
vidar
http://5.182.86.94:80
https://t.me/vookihhfds
https://t.me/secgoxrp
https://steamcommunity.com/profiles/76561199568528949
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:110.0) Gecko/20100101 Firefox/121.0
Signatures
-
Detect Vidar Stealer 2 IoCs
resource yara_rule behavioral2/memory/4840-4-0x00000000002E0000-0x0000000000D2D000-memory.dmp family_vidar_v7 behavioral2/memory/4840-18-0x00000000002E0000-0x0000000000D2D000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\Control Panel\International\Geo\Nation Set-up.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Set-up.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Set-up.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2276 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4840 Set-up.exe 4840 Set-up.exe 4840 Set-up.exe 4840 Set-up.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4840 wrote to memory of 2724 4840 Set-up.exe 91 PID 4840 wrote to memory of 2724 4840 Set-up.exe 91 PID 4840 wrote to memory of 2724 4840 Set-up.exe 91 PID 2724 wrote to memory of 2276 2724 cmd.exe 93 PID 2724 wrote to memory of 2276 2724 cmd.exe 93 PID 2724 wrote to memory of 2276 2724 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe"C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe"1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe" & del "C:\ProgramData\*.dll"" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:2276
-
-