Analysis
-
max time kernel
142s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-04-2024 09:55
Behavioral task
behavioral1
Sample
1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe
Resource
win7-20240221-en
General
-
Target
1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe
-
Size
5.1MB
-
MD5
58c40d0ad81f25bcd68a5523d867eb34
-
SHA1
4066f9bdb046b6feaf612bc7571f8b0f3a1ca169
-
SHA256
1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367
-
SHA512
e43c16f3df411c5bd26a4491be86071c135facfce42a8b48608224060216c6b5552bf7d2fd25eccecd4fea27ad3d2e1e1c7ea03a8999430056ca8a33e29399dd
-
SSDEEP
98304:B5Sn52sYtLDfSR654zrPp8/Rq3ZEVkERxCFJiT0Gu4ueeZT:w4sxR65OpsEZEVjvMJiAMutT
Malware Config
Extracted
vidar
53.4
1364
https://t.me/cheaptrains
https://mastodon.social/@ffolegg94
-
profile_id
1364
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe -
Vidar Stealer 8 IoCs
Processes:
resource yara_rule behavioral1/memory/3012-3-0x0000000000F90000-0x00000000014DE000-memory.dmp family_vidar behavioral1/memory/3012-4-0x0000000000F90000-0x00000000014DE000-memory.dmp family_vidar behavioral1/memory/3012-5-0x0000000000F90000-0x00000000014DE000-memory.dmp family_vidar behavioral1/memory/3012-6-0x0000000000F90000-0x00000000014DE000-memory.dmp family_vidar behavioral1/memory/3012-8-0x0000000000F90000-0x00000000014DE000-memory.dmp family_vidar behavioral1/memory/3012-7-0x0000000000F90000-0x00000000014DE000-memory.dmp family_vidar behavioral1/memory/3012-9-0x0000000000F90000-0x00000000014DE000-memory.dmp family_vidar behavioral1/memory/3012-18-0x0000000000F90000-0x00000000014DE000-memory.dmp family_vidar -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe -
Processes:
resource yara_rule behavioral1/memory/3012-0-0x0000000000F90000-0x00000000014DE000-memory.dmp themida behavioral1/memory/3012-2-0x0000000000F90000-0x00000000014DE000-memory.dmp themida behavioral1/memory/3012-3-0x0000000000F90000-0x00000000014DE000-memory.dmp themida behavioral1/memory/3012-4-0x0000000000F90000-0x00000000014DE000-memory.dmp themida behavioral1/memory/3012-5-0x0000000000F90000-0x00000000014DE000-memory.dmp themida behavioral1/memory/3012-6-0x0000000000F90000-0x00000000014DE000-memory.dmp themida behavioral1/memory/3012-8-0x0000000000F90000-0x00000000014DE000-memory.dmp themida behavioral1/memory/3012-7-0x0000000000F90000-0x00000000014DE000-memory.dmp themida behavioral1/memory/3012-9-0x0000000000F90000-0x00000000014DE000-memory.dmp themida behavioral1/memory/3012-18-0x0000000000F90000-0x00000000014DE000-memory.dmp themida -
Processes:
1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exepid process 3012 1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exepid process 3012 1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe"C:\Users\Admin\AppData\Local\Temp\1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3012-0-0x0000000000F90000-0x00000000014DE000-memory.dmpFilesize
5.3MB
-
memory/3012-1-0x0000000077BF0000-0x0000000077BF2000-memory.dmpFilesize
8KB
-
memory/3012-2-0x0000000000F90000-0x00000000014DE000-memory.dmpFilesize
5.3MB
-
memory/3012-3-0x0000000000F90000-0x00000000014DE000-memory.dmpFilesize
5.3MB
-
memory/3012-4-0x0000000000F90000-0x00000000014DE000-memory.dmpFilesize
5.3MB
-
memory/3012-5-0x0000000000F90000-0x00000000014DE000-memory.dmpFilesize
5.3MB
-
memory/3012-6-0x0000000000F90000-0x00000000014DE000-memory.dmpFilesize
5.3MB
-
memory/3012-8-0x0000000000F90000-0x00000000014DE000-memory.dmpFilesize
5.3MB
-
memory/3012-7-0x0000000000F90000-0x00000000014DE000-memory.dmpFilesize
5.3MB
-
memory/3012-9-0x0000000000F90000-0x00000000014DE000-memory.dmpFilesize
5.3MB
-
memory/3012-18-0x0000000000F90000-0x00000000014DE000-memory.dmpFilesize
5.3MB