Overview

overview

10

Static

static

3

Set-up.exe

windows7-x64

10

Set-up.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    1346s
  • max time network
    1413s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    27-02-2024 01:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Set-up.exe

  • Size

    136.2MB

  • MD5

    df14d372ecdd495127d1c3950b4a4c9c

  • SHA1

    384e35f8f938b27ea2f4b97afc798a25b67ae853

  • SHA256

    99c80e54400e52454d0f52f294a7b05b8e05386e4a2e9007f41393fee0654cf8

  • SHA512

    a7b980adfb7ad369538743c408ee5df557d50c698fd1000aaf702c29a9b16905526287d1e8f840335834945dba776247323b83a730019aa39940bac23d2d0659

  • SSDEEP

    196608:jjrU7vglcF8zp0zKmSMc8lhjjk3D1GMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMl:jRyDSMxfoTr

Score
10/10
vidar97b92d10859a319d8736cd53ff3f8868stealer

Malware Config

Extracted

Family

vidar

Version

7.8

Botnet

97b92d10859a319d8736cd53ff3f8868

C2

http://5.252.118.12:80

https://t.me/voolkisms

https://t.me/karl3on

https://steamcommunity.com/profiles/76561199637071579
Attributes
  • profile_id_v2

    97b92d10859a319d8736cd53ff3f8868

  • user_agent

    Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Signatures

  • Detect Vidar Stealer 3 IoCs
    stealer
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 61 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Set-up.exe
    "C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1724
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 1376
      2⤵
      • Program crash
      PID:4660
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1724 -ip 1724
    1⤵
      PID:4436
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /0
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3936

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1724-1-0x0000000000500000-0x0000000000F2D000-memory.dmp
      Filesize

      10.2MB

      Download
    • memory/1724-2-0x000000000CF30000-0x000000000CF31000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1724-0-0x000000000CE10000-0x000000000CE11000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1724-3-0x000000000CF40000-0x000000000CF41000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1724-4-0x000000000CF70000-0x000000000CF71000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1724-5-0x000000000E730000-0x000000000E731000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1724-6-0x000000000E740000-0x000000000E741000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1724-7-0x000000000E750000-0x000000000E751000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1724-8-0x0000000000500000-0x0000000000F2D000-memory.dmp
      Filesize

      10.2MB

      Download
    • memory/1724-11-0x0000000000500000-0x0000000000F2D000-memory.dmp
      Filesize

      10.2MB

      Download
    • memory/3936-12-0x00000143F80C0000-0x00000143F80C1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3936-13-0x00000143F80C0000-0x00000143F80C1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3936-14-0x00000143F80C0000-0x00000143F80C1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3936-19-0x00000143F80C0000-0x00000143F80C1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3936-24-0x00000143F80C0000-0x00000143F80C1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3936-23-0x00000143F80C0000-0x00000143F80C1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3936-22-0x00000143F80C0000-0x00000143F80C1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3936-21-0x00000143F80C0000-0x00000143F80C1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3936-20-0x00000143F80C0000-0x00000143F80C1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3936-18-0x00000143F80C0000-0x00000143F80C1000-memory.dmp
      Filesize

      4KB

      Download