Analysis

  • max time kernel
    144s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-05-2024 01:27

General

  • Target

    #Frée-FɨLéŜ-!PằŜSwṟo͍d--63180/Setup.exe

  • Size

    8.5MB

  • MD5

    98169506fec94c2b12ba9930ad704515

  • SHA1

    bce662a9fb94551f648ba2d7e29659957fd6a428

  • SHA256

    9b8a5b0a45adf843e24214b46c285e44e73bc6eaf9e2a3b2c14a6d93ae541363

  • SHA512

    7f4f7ac2326a1a8b7afc72822dae328753578eb0a4ffcec5adb4e4fb0c49703070f71e7411df221ee9f44d6b43a0a94921fe530877c5d5e71640b807e96def30

  • SSDEEP

    196608:vdoUox8PFOegKz+qE1cnuyHgv3eZaOxqeXY4K:vC0O9m7EWEvbOxqetK

Malware Config

Extracted

Family

vidar

Botnet

3c6ffb3181118d4e1071419a800b7369

C2

https://redddog.xyz

https://steamcommunity.com/profiles/76561199677575543

https://t.me/snsb82

Attributes
  • profile_id_v2

    3c6ffb3181118d4e1071419a800b7369

  • user_agent

    Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/8.0.500.0 Safari/534.6

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Detect Vidar Stealer 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\#Frée-FɨLéŜ-!PằŜSwṟo͍d--63180\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\#Frée-FɨLéŜ-!PằŜSwṟo͍d--63180\Setup.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Suspicious use of SetThreadContext
    • Registers COM server for autorun
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4276
    • C:\Windows\SysWOW64\netsh.exe
      C:\Windows\SysWOW64\netsh.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:5632
      • C:\Users\Admin\AppData\Local\Temp\BvInputDiag.exe
        C:\Users\Admin\AppData\Local\Temp\BvInputDiag.exe
        3⤵
        • Loads dropped DLL
        PID:812
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 1944
          4⤵
          • Program crash
          PID:3200
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 812 -ip 812
    1⤵
      PID:6116

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Virtualization/Sandbox Evasion

    1
    T1497

    Discovery

    Query Registry

    2
    T1012

    Virtualization/Sandbox Evasion

    1
    T1497

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\BvInputDiag.exe
      Filesize

      136KB

      MD5

      3d754cfa4a5b2a3f19720550acf6d3cf

      SHA1

      e5c78edbd54e14a42258a6c223d2cf128530e1b6

      SHA256

      8e5e627881c8182bfbb64601c6f4f7b30ba950dfd10f638f404479406b2c03b8

      SHA512

      18db06443a718b8233ac9724e7f96310bf5841d2c980cd1d02e6fb6743e23acc13bd67fcd214b4c0650ac933f6f081759d699c73e14baf26ffc324c2b30f153b

    • C:\Users\Admin\AppData\Local\Temp\a097cf38
      Filesize

      6.0MB

      MD5

      e2ddd22c4c477d869ba7b1ff83629f4f

      SHA1

      1a8edb1b82f963846297171c8fe25ed7d693f570

      SHA256

      f6ece4e4f7747c7d561022dc623081ec72e857023a4183f7df611fefd47ed1b4

      SHA512

      99acb5c52922a16373f138f2bea44e95a7320325b77d882d4b4068642ed9e3811e87a4ea26b484eeed26162a0ec2347f231527982f38ee84068a7f1b0fc77ba9

    • memory/812-57-0x0000000000B70000-0x00000000012BB000-memory.dmp
      Filesize

      7.3MB

    • memory/812-56-0x0000000000B70000-0x00000000012BB000-memory.dmp
      Filesize

      7.3MB

    • memory/812-49-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
      Filesize

      2.0MB

    • memory/4276-35-0x00007FFA0FF50000-0x00007FFA100C2000-memory.dmp
      Filesize

      1.4MB

    • memory/4276-17-0x0000000000400000-0x0000000001CF7000-memory.dmp
      Filesize

      25.0MB

    • memory/4276-19-0x0000000000400000-0x0000000001CF7000-memory.dmp
      Filesize

      25.0MB

    • memory/4276-20-0x00007FFA0FF50000-0x00007FFA100C2000-memory.dmp
      Filesize

      1.4MB

    • memory/4276-34-0x00007FFA0FF68000-0x00007FFA0FF69000-memory.dmp
      Filesize

      4KB

    • memory/4276-0-0x0000000003FB0000-0x0000000004198000-memory.dmp
      Filesize

      1.9MB

    • memory/4276-36-0x00007FFA0FF50000-0x00007FFA100C2000-memory.dmp
      Filesize

      1.4MB

    • memory/4276-16-0x0000000000400000-0x0000000001CF7000-memory.dmp
      Filesize

      25.0MB

    • memory/4276-10-0x0000000000400000-0x0000000001CF7000-memory.dmp
      Filesize

      25.0MB

    • memory/4276-12-0x0000000000400000-0x0000000001CF7000-memory.dmp
      Filesize

      25.0MB

    • memory/4276-14-0x0000000000400000-0x0000000001CF7000-memory.dmp
      Filesize

      25.0MB

    • memory/4276-15-0x0000000000400000-0x0000000001CF7000-memory.dmp
      Filesize

      25.0MB

    • memory/5632-46-0x0000000073F11000-0x0000000073F1F000-memory.dmp
      Filesize

      56KB

    • memory/5632-42-0x0000000073F1E000-0x0000000073F20000-memory.dmp
      Filesize

      8KB

    • memory/5632-43-0x0000000073F11000-0x0000000073F1F000-memory.dmp
      Filesize

      56KB

    • memory/5632-39-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
      Filesize

      2.0MB