Analysis
-
max time kernel
92s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 13:27
Static task
static1
Behavioral task
behavioral1
Sample
b8b6d94f2e3b6ae6be5205ef84ae0332.exe
Resource
win7-20240508-en
General
-
Target
b8b6d94f2e3b6ae6be5205ef84ae0332.exe
-
Size
2.7MB
-
MD5
b8b6d94f2e3b6ae6be5205ef84ae0332
-
SHA1
5ddf798d3d0a007a030a102e6bfc150e5a08ea83
-
SHA256
484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b
-
SHA512
968a81025278fe2598961e1376f4c144dd20979f316231093157dee7364713265675070d67c08510b574966e6178264d7e4d350c15cd5eaa7026ca3e9a2f45b3
-
SSDEEP
49152:KFzUITu6rv7vkceIsWGIgT+pFeawTkvBt:KKfYv4J0wTQB
Malware Config
Extracted
stealc
Extracted
vidar
https://steamcommunity.com/profiles/76561199689717899
https://t.me/copterwin
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Signatures
-
Detect Vidar Stealer 5 IoCs
Processes:
resource yara_rule behavioral2/memory/388-68-0x0000000000400000-0x0000000000646000-memory.dmp family_vidar_v7 behavioral2/memory/388-66-0x0000000000400000-0x0000000000646000-memory.dmp family_vidar_v7 behavioral2/memory/388-73-0x0000000000400000-0x0000000000646000-memory.dmp family_vidar_v7 behavioral2/memory/388-76-0x0000000000400000-0x0000000000646000-memory.dmp family_vidar_v7 behavioral2/memory/388-96-0x0000000000400000-0x0000000000646000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
b8b6d94f2e3b6ae6be5205ef84ae0332.exedescription pid process target process PID 1532 set thread context of 388 1532 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe -
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MSBuild.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
MSBuild.exepid process 388 MSBuild.exe 388 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b8b6d94f2e3b6ae6be5205ef84ae0332.exedescription pid process Token: SeDebugPrivilege 1532 b8b6d94f2e3b6ae6be5205ef84ae0332.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
b8b6d94f2e3b6ae6be5205ef84ae0332.exedescription pid process target process PID 1532 wrote to memory of 388 1532 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe PID 1532 wrote to memory of 388 1532 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe PID 1532 wrote to memory of 388 1532 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe PID 1532 wrote to memory of 388 1532 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe PID 1532 wrote to memory of 388 1532 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe PID 1532 wrote to memory of 388 1532 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe PID 1532 wrote to memory of 388 1532 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe PID 1532 wrote to memory of 388 1532 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe PID 1532 wrote to memory of 388 1532 b8b6d94f2e3b6ae6be5205ef84ae0332.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8b6d94f2e3b6ae6be5205ef84ae0332.exe"C:\Users\Admin\AppData\Local\Temp\b8b6d94f2e3b6ae6be5205ef84ae0332.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/388-68-0x0000000000400000-0x0000000000646000-memory.dmpFilesize
2.3MB
-
memory/388-96-0x0000000000400000-0x0000000000646000-memory.dmpFilesize
2.3MB
-
memory/388-76-0x0000000000400000-0x0000000000646000-memory.dmpFilesize
2.3MB
-
memory/388-73-0x0000000000400000-0x0000000000646000-memory.dmpFilesize
2.3MB
-
memory/388-66-0x0000000000400000-0x0000000000646000-memory.dmpFilesize
2.3MB
-
memory/1532-43-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-39-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-11-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-65-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-64-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-4-0x0000000005AB0000-0x0000000005ACC000-memory.dmpFilesize
112KB
-
memory/1532-70-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/1532-5-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/1532-61-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-59-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-57-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-55-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-53-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-51-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-49-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-47-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-45-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-0-0x00000000752AE000-0x00000000752AF000-memory.dmpFilesize
4KB
-
memory/1532-41-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-13-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-37-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-35-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-33-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-29-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-27-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-25-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-16-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-10-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-6-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-32-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-23-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-21-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-19-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-17-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-7-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/1532-3-0x0000000005CD0000-0x0000000005D68000-memory.dmpFilesize
608KB
-
memory/1532-72-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/1532-2-0x0000000005C30000-0x0000000005CCC000-memory.dmpFilesize
624KB
-
memory/1532-1-0x0000000000ED0000-0x0000000001182000-memory.dmpFilesize
2.7MB
-
memory/1532-97-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB