Analysis
-
max time kernel
452s -
max time network
454s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
27-05-2024 23:09
Static task
static1
General
-
Target
Wefaceswap.exe
-
Size
36.1MB
-
MD5
ccacce8535f682dd67c701d9157ef218
-
SHA1
5f72f5e427590a0c5e184cb013d27cc3d1af265f
-
SHA256
f954f818007b508badc400417584ae7726a71f4b697d8b1eb13184318ef1eda1
-
SHA512
ea0816462acc433c02800f43f7d979db68d2ec78e075e2d9f0a776b9ba24b5e27ad36d9e1bab0f0276585de422b42553b2fc9c1e2571e50861bd2fd66a6ce576
-
SSDEEP
393216:B1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYf6:BMguj8Q4VfvfqFTrYx
Malware Config
Extracted
stealc
Extracted
vidar
http://116.203.7.199:80
https://steamcommunity.com/profiles/76561199689717899
https://t.me/copterwin
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Signatures
-
Detect Vidar Stealer 12 IoCs
Processes:
resource yara_rule behavioral1/memory/4684-36-0x0000000000E40000-0x0000000001086000-memory.dmp family_vidar_v7 behavioral1/memory/2464-37-0x0000000000400000-0x00000000006C3000-memory.dmp family_vidar_v7 behavioral1/memory/4684-38-0x0000000000E40000-0x0000000001086000-memory.dmp family_vidar_v7 behavioral1/memory/4684-39-0x0000000000E40000-0x0000000001086000-memory.dmp family_vidar_v7 behavioral1/memory/4684-55-0x0000000000E40000-0x0000000001086000-memory.dmp family_vidar_v7 behavioral1/memory/4684-56-0x0000000000E40000-0x0000000001086000-memory.dmp family_vidar_v7 behavioral1/memory/4684-72-0x0000000000E40000-0x0000000001086000-memory.dmp family_vidar_v7 behavioral1/memory/4684-73-0x0000000000E40000-0x0000000001086000-memory.dmp family_vidar_v7 behavioral1/memory/4684-107-0x0000000000E40000-0x0000000001086000-memory.dmp family_vidar_v7 behavioral1/memory/4684-108-0x0000000000E40000-0x0000000001086000-memory.dmp family_vidar_v7 behavioral1/memory/4684-118-0x0000000000E40000-0x0000000001086000-memory.dmp family_vidar_v7 behavioral1/memory/4684-119-0x0000000000E40000-0x0000000001086000-memory.dmp family_vidar_v7 -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
payload_pump_Q7IR.exepayload_pump_Q7IR.exepid process 2464 payload_pump_Q7IR.exe 4684 payload_pump_Q7IR.exe -
Loads dropped DLL 2 IoCs
Processes:
payload_pump_Q7IR.exepid process 4684 payload_pump_Q7IR.exe 4684 payload_pump_Q7IR.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
payload_pump_Q7IR.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000\Software\Microsoft\Windows\CurrentVersion\Run\TopicLT = "C:\\Users\\Admin\\Documents\\OOOpLLC\\Tuniut.exe" payload_pump_Q7IR.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
payload_pump_Q7IR.exepid process 2464 payload_pump_Q7IR.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
payload_pump_Q7IR.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString payload_pump_Q7IR.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1892 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepayload_pump_Q7IR.exepid process 892 powershell.exe 892 powershell.exe 4684 payload_pump_Q7IR.exe 4684 payload_pump_Q7IR.exe 4684 payload_pump_Q7IR.exe 4684 payload_pump_Q7IR.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 892 powershell.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Wefaceswap.execmd.exepowershell.exepayload_pump_Q7IR.exepayload_pump_Q7IR.execmd.exedescription pid process target process PID 2632 wrote to memory of 340 2632 Wefaceswap.exe cmd.exe PID 2632 wrote to memory of 340 2632 Wefaceswap.exe cmd.exe PID 340 wrote to memory of 892 340 cmd.exe powershell.exe PID 340 wrote to memory of 892 340 cmd.exe powershell.exe PID 892 wrote to memory of 2464 892 powershell.exe payload_pump_Q7IR.exe PID 892 wrote to memory of 2464 892 powershell.exe payload_pump_Q7IR.exe PID 892 wrote to memory of 2464 892 powershell.exe payload_pump_Q7IR.exe PID 2464 wrote to memory of 4684 2464 payload_pump_Q7IR.exe payload_pump_Q7IR.exe PID 2464 wrote to memory of 4684 2464 payload_pump_Q7IR.exe payload_pump_Q7IR.exe PID 2464 wrote to memory of 4684 2464 payload_pump_Q7IR.exe payload_pump_Q7IR.exe PID 2464 wrote to memory of 4684 2464 payload_pump_Q7IR.exe payload_pump_Q7IR.exe PID 2464 wrote to memory of 4684 2464 payload_pump_Q7IR.exe payload_pump_Q7IR.exe PID 2464 wrote to memory of 4684 2464 payload_pump_Q7IR.exe payload_pump_Q7IR.exe PID 4684 wrote to memory of 4484 4684 payload_pump_Q7IR.exe cmd.exe PID 4684 wrote to memory of 4484 4684 payload_pump_Q7IR.exe cmd.exe PID 4684 wrote to memory of 4484 4684 payload_pump_Q7IR.exe cmd.exe PID 4484 wrote to memory of 1892 4484 cmd.exe timeout.exe PID 4484 wrote to memory of 1892 4484 cmd.exe timeout.exe PID 4484 wrote to memory of 1892 4484 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wefaceswap.exe"C:\Users\Admin\AppData\Local\Temp\Wefaceswap.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -Command "& { . 'C:\Users\Admin\AppData\Local\mEifUllJYx\LwVm.ps1'; StartWork -path "C:\Users\Admin\AppData\Local\JhkQgLkOZS\ujieR\payload_pump_Q7IR.exe" }" -WindowStyle Hidden"2⤵
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -Command "& { . 'C:\Users\Admin\AppData\Local\mEifUllJYx\LwVm.ps1'; StartWork -path "C:\Users\Admin\AppData\Local\JhkQgLkOZS\ujieR\payload_pump_Q7IR.exe" }" -WindowStyle Hidden3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\JhkQgLkOZS\ujieR\payload_pump_Q7IR.exe"C:\Users\Admin\AppData\Local\JhkQgLkOZS\ujieR\payload_pump_Q7IR.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\JhkQgLkOZS\ujieR\payload_pump_Q7IR.exe"C:\Users\Admin\AppData\Local\JhkQgLkOZS\ujieR\payload_pump_Q7IR.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IDHJEBGIEBFI" & exit6⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\timeout.exetimeout /t 107⤵
- Delays execution with timeout.exe
PID:1892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\IDHJEBGIEBFI\VCRUNT~1.DLLFilesize
78KB
MD5a37ee36b536409056a86f50e67777dd7
SHA11cafa159292aa736fc595fc04e16325b27cd6750
SHA2568934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA5123a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
-
C:\ProgramData\IDHJEBGIEBFI\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\IDHJEBGIEBFI\msvcp140.dllFilesize
439KB
MD55ff1fca37c466d6723ec67be93b51442
SHA134cc4e158092083b13d67d6d2bc9e57b798a303b
SHA2565136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA5124802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546
-
C:\ProgramData\IDHJEBGIEBFI\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\ProgramData\IDHJEBGIEBFI\softokn3.dllFilesize
251KB
MD54e52d739c324db8225bd9ab2695f262f
SHA171c3da43dc5a0d2a1941e874a6d015a071783889
SHA25674ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA5122d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r0t0gd05.jht.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\mEifUllJYx\LwVm.ps1Filesize
219B
MD50c369a96d03b668daf4b82f42897762d
SHA1a683048209043670fd41354b049f59492b63efd3
SHA256ede7669162acab81c614020c588f11d7ad0d4da7f159efff72c9eeeff6c2f404
SHA512ee2c3b4c062235e2d3ea3a1cbba76e174412e48fa2851192222c6dec86b84f50507f01689a2015eaa7d704816919d16271f6fe7c646d3126f3638c755431c745
-
memory/892-29-0x00007FFF0D8F0000-0x00007FFF0E3B2000-memory.dmpFilesize
10.8MB
-
memory/892-17-0x000001C1B3F70000-0x000001C1B3F92000-memory.dmpFilesize
136KB
-
memory/892-21-0x00007FFF0D8F0000-0x00007FFF0E3B2000-memory.dmpFilesize
10.8MB
-
memory/892-22-0x00007FFF0D8F0000-0x00007FFF0E3B2000-memory.dmpFilesize
10.8MB
-
memory/892-24-0x00007FFF0D8F0000-0x00007FFF0E3B2000-memory.dmpFilesize
10.8MB
-
memory/892-11-0x00007FFF0D8F3000-0x00007FFF0D8F5000-memory.dmpFilesize
8KB
-
memory/2464-30-0x0000000000400000-0x00000000006C3000-memory.dmpFilesize
2.8MB
-
memory/2464-32-0x0000000000400000-0x00000000006C3000-memory.dmpFilesize
2.8MB
-
memory/2464-31-0x0000000000400000-0x00000000006C3000-memory.dmpFilesize
2.8MB
-
memory/2464-37-0x0000000000400000-0x00000000006C3000-memory.dmpFilesize
2.8MB
-
memory/4684-56-0x0000000000E40000-0x0000000001086000-memory.dmpFilesize
2.3MB
-
memory/4684-55-0x0000000000E40000-0x0000000001086000-memory.dmpFilesize
2.3MB
-
memory/4684-72-0x0000000000E40000-0x0000000001086000-memory.dmpFilesize
2.3MB
-
memory/4684-73-0x0000000000E40000-0x0000000001086000-memory.dmpFilesize
2.3MB
-
memory/4684-41-0x0000000011340000-0x000000001159F000-memory.dmpFilesize
2.4MB
-
memory/4684-39-0x0000000000E40000-0x0000000001086000-memory.dmpFilesize
2.3MB
-
memory/4684-107-0x0000000000E40000-0x0000000001086000-memory.dmpFilesize
2.3MB
-
memory/4684-108-0x0000000000E40000-0x0000000001086000-memory.dmpFilesize
2.3MB
-
memory/4684-118-0x0000000000E40000-0x0000000001086000-memory.dmpFilesize
2.3MB
-
memory/4684-119-0x0000000000E40000-0x0000000001086000-memory.dmpFilesize
2.3MB
-
memory/4684-38-0x0000000000E40000-0x0000000001086000-memory.dmpFilesize
2.3MB
-
memory/4684-36-0x0000000000E40000-0x0000000001086000-memory.dmpFilesize
2.3MB
-
memory/4684-33-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB