Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-02-2024 01:01
Static task
static1
Behavioral task
behavioral1
Sample
Set-up.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Set-up.exe
Resource
win10v2004-20240226-en
General
-
Target
Set-up.exe
-
Size
546.4MB
-
MD5
59b2710c6120d4059f6a3517ee8beae3
-
SHA1
fc68df0d66802d7ffbe9ac4681aee7461cfe5759
-
SHA256
65da752a44fd96fc79011c3b15d1e2523daa79c72a07cf9bf68f480cf38e595e
-
SHA512
54b7caab20a3082965729e9adb8e44e401a5a139f56954598335ca1f56c484ce290a36baccef49465309a795bc5d888a3ea65193eed45ab2ff443681db0bb7fc
-
SSDEEP
196608:jjrU7vglcF8zp0zKmSMc8lhjjk3D1GMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMl:jRyDSMxfoTH
Malware Config
Extracted
vidar
7.8
97b92d10859a319d8736cd53ff3f8868
http://5.252.118.12:80
https://t.me/voolkisms
https://t.me/karl3on
https://steamcommunity.com/profiles/76561199637071579
-
profile_id_v2
97b92d10859a319d8736cd53ff3f8868
-
user_agent
Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9
Signatures
-
Detect Vidar Stealer 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2376-2-0x00000000001F0000-0x0000000000C1D000-memory.dmp family_vidar_v7 behavioral1/memory/2376-37-0x00000000001F0000-0x0000000000C1D000-memory.dmp family_vidar_v7 behavioral1/memory/2376-40-0x00000000001F0000-0x0000000000C1D000-memory.dmp family_vidar_v7 behavioral1/memory/1068-41-0x0000000140000000-0x00000001405E8000-memory.dmp family_vidar_v7 behavioral1/memory/1068-45-0x0000000140000000-0x00000001405E8000-memory.dmp family_vidar_v7 -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2592 2376 WerFault.exe Set-up.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Set-up.exetaskmgr.exepid process 2376 Set-up.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 1068 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 1068 taskmgr.exe Token: SeShutdownPrivilege 1068 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe 1068 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Set-up.exedescription pid process target process PID 2376 wrote to memory of 2592 2376 Set-up.exe WerFault.exe PID 2376 wrote to memory of 2592 2376 Set-up.exe WerFault.exe PID 2376 wrote to memory of 2592 2376 Set-up.exe WerFault.exe PID 2376 wrote to memory of 2592 2376 Set-up.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Set-up.exe"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 8602⤵
- Program crash
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1068-42-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1068-46-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1068-45-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1068-41-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2376-21-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2376-29-0x0000000000C30000-0x0000000000C31000-memory.dmpFilesize
4KB
-
memory/2376-9-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2376-12-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2376-11-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2376-14-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2376-16-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2376-19-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2376-0-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2376-24-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/2376-26-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/2376-7-0x0000000077CD0000-0x0000000077CD1000-memory.dmpFilesize
4KB
-
memory/2376-31-0x0000000000C30000-0x0000000000C31000-memory.dmpFilesize
4KB
-
memory/2376-34-0x0000000000C40000-0x0000000000C41000-memory.dmpFilesize
4KB
-
memory/2376-36-0x0000000000C40000-0x0000000000C41000-memory.dmpFilesize
4KB
-
memory/2376-37-0x00000000001F0000-0x0000000000C1D000-memory.dmpFilesize
10.2MB
-
memory/2376-40-0x00000000001F0000-0x0000000000C1D000-memory.dmpFilesize
10.2MB
-
memory/2376-6-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2376-5-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2376-3-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2376-2-0x00000000001F0000-0x0000000000C1D000-memory.dmpFilesize
10.2MB