Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 13:27
Static task
static1
Behavioral task
behavioral1
Sample
b8b6d94f2e3b6ae6be5205ef84ae0332.exe
Resource
win7-20240508-en
General
-
Target
b8b6d94f2e3b6ae6be5205ef84ae0332.exe
-
Size
2.7MB
-
MD5
b8b6d94f2e3b6ae6be5205ef84ae0332
-
SHA1
5ddf798d3d0a007a030a102e6bfc150e5a08ea83
-
SHA256
484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b
-
SHA512
968a81025278fe2598961e1376f4c144dd20979f316231093157dee7364713265675070d67c08510b574966e6178264d7e4d350c15cd5eaa7026ca3e9a2f45b3
-
SSDEEP
49152:KFzUITu6rv7vkceIsWGIgT+pFeawTkvBt:KKfYv4J0wTQB
Malware Config
Extracted
stealc
Extracted
vidar
https://steamcommunity.com/profiles/76561199689717899
https://t.me/copterwin
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Signatures
-
Detect Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2576-69-0x0000000000400000-0x0000000000646000-memory.dmp family_vidar_v7 behavioral1/memory/2576-75-0x0000000000400000-0x0000000000646000-memory.dmp family_vidar_v7 behavioral1/memory/2576-290-0x0000000000400000-0x0000000000646000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
b8b6d94f2e3b6ae6be5205ef84ae0332.exedescription pid process target process PID 108 set thread context of 2576 108 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe -
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MSBuild.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
MSBuild.exepid process 2576 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b8b6d94f2e3b6ae6be5205ef84ae0332.exedescription pid process Token: SeDebugPrivilege 108 b8b6d94f2e3b6ae6be5205ef84ae0332.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
b8b6d94f2e3b6ae6be5205ef84ae0332.exedescription pid process target process PID 108 wrote to memory of 2576 108 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe PID 108 wrote to memory of 2576 108 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe PID 108 wrote to memory of 2576 108 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe PID 108 wrote to memory of 2576 108 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe PID 108 wrote to memory of 2576 108 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe PID 108 wrote to memory of 2576 108 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe PID 108 wrote to memory of 2576 108 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe PID 108 wrote to memory of 2576 108 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe PID 108 wrote to memory of 2576 108 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe PID 108 wrote to memory of 2576 108 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8b6d94f2e3b6ae6be5205ef84ae0332.exe"C:\Users\Admin\AppData\Local\Temp\b8b6d94f2e3b6ae6be5205ef84ae0332.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Cab2648.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar2679.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
memory/108-40-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-6-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-3-0x0000000000790000-0x00000000007AC000-memory.dmpFilesize
112KB
-
memory/108-38-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-5-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-12-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-24-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-44-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-64-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-62-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-0-0x0000000074CAE000-0x0000000074CAF000-memory.dmpFilesize
4KB
-
memory/108-58-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-36-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-56-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-55-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-52-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-50-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-48-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-46-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-42-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-60-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-4-0x0000000074CA0000-0x000000007538E000-memory.dmpFilesize
6.9MB
-
memory/108-65-0x0000000074CA0000-0x000000007538E000-memory.dmpFilesize
6.9MB
-
memory/108-34-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-32-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-30-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-28-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-26-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-22-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-20-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-18-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-16-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-14-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-10-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-8-0x0000000000790000-0x00000000007A5000-memory.dmpFilesize
84KB
-
memory/108-1-0x0000000000100000-0x00000000003B2000-memory.dmpFilesize
2.7MB
-
memory/108-2-0x00000000022C0000-0x0000000002358000-memory.dmpFilesize
608KB
-
memory/108-76-0x0000000074CA0000-0x000000007538E000-memory.dmpFilesize
6.9MB
-
memory/2576-75-0x0000000000400000-0x0000000000646000-memory.dmpFilesize
2.3MB
-
memory/2576-67-0x0000000000400000-0x0000000000646000-memory.dmpFilesize
2.3MB
-
memory/2576-68-0x0000000000400000-0x0000000000646000-memory.dmpFilesize
2.3MB
-
memory/2576-69-0x0000000000400000-0x0000000000646000-memory.dmpFilesize
2.3MB
-
memory/2576-66-0x0000000000400000-0x0000000000646000-memory.dmpFilesize
2.3MB
-
memory/2576-290-0x0000000000400000-0x0000000000646000-memory.dmpFilesize
2.3MB