Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/04/2024, 13:05
Static task
static1
Behavioral task
behavioral1
Sample
6aff6b910d2970d554e4b45f92bc54619f70f97455c97600bc898ff5d4a6a24f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6aff6b910d2970d554e4b45f92bc54619f70f97455c97600bc898ff5d4a6a24f.exe
Resource
win10v2004-20240226-en
General
-
Target
6aff6b910d2970d554e4b45f92bc54619f70f97455c97600bc898ff5d4a6a24f.exe
-
Size
271KB
-
MD5
4bb20ea325849c0aeca1db328d599f12
-
SHA1
1713d9411cac432d72dd8f4725291ec8a0fe2cda
-
SHA256
6aff6b910d2970d554e4b45f92bc54619f70f97455c97600bc898ff5d4a6a24f
-
SHA512
97030ab98719810caaf2aa3a01d2f07cfdfe77b24ecc9e7504c94369978ef202d33afcd829e1cae9b1e8b88d6b2641a12235c481bb9208d0be6b2b7efd5a156e
-
SSDEEP
3072:O3UalltAlB/S3PbzkkTpFR14FJGmvZyFNd5F73CiiV4AouXKbQWOz1:uU8tAlB63/kk0FJ7vZoF73fH+xt
Malware Config
Extracted
vidar
6.4
d86c4f40f00f981f1ba8ba07d4c6a092
https://t.me/secgoxrp
https://steamcommunity.com/profiles/76561199568528949
-
profile_id_v2
d86c4f40f00f981f1ba8ba07d4c6a092
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:110.0) Gecko/20100101 Firefox/121.0
Signatures
-
Detect Vidar Stealer 3 IoCs
resource yara_rule behavioral2/memory/1764-2-0x0000000002510000-0x0000000002536000-memory.dmp family_vidar_v7 behavioral2/memory/1764-3-0x0000000000400000-0x00000000007CD000-memory.dmp family_vidar_v7 behavioral2/memory/1764-17-0x0000000000400000-0x00000000007CD000-memory.dmp family_vidar_v7 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 3616 1764 WerFault.exe 85 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 6aff6b910d2970d554e4b45f92bc54619f70f97455c97600bc898ff5d4a6a24f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 6aff6b910d2970d554e4b45f92bc54619f70f97455c97600bc898ff5d4a6a24f.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1764 6aff6b910d2970d554e4b45f92bc54619f70f97455c97600bc898ff5d4a6a24f.exe 1764 6aff6b910d2970d554e4b45f92bc54619f70f97455c97600bc898ff5d4a6a24f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6aff6b910d2970d554e4b45f92bc54619f70f97455c97600bc898ff5d4a6a24f.exe"C:\Users\Admin\AppData\Local\Temp\6aff6b910d2970d554e4b45f92bc54619f70f97455c97600bc898ff5d4a6a24f.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1764 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 20322⤵
- Program crash
PID:3616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1764 -ip 17641⤵PID:2560