Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 01:10
Static task
static1
Behavioral task
behavioral1
Sample
484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exe
Resource
win7-20240221-en
General
-
Target
484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exe
-
Size
2.7MB
-
MD5
b8b6d94f2e3b6ae6be5205ef84ae0332
-
SHA1
5ddf798d3d0a007a030a102e6bfc150e5a08ea83
-
SHA256
484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b
-
SHA512
968a81025278fe2598961e1376f4c144dd20979f316231093157dee7364713265675070d67c08510b574966e6178264d7e4d350c15cd5eaa7026ca3e9a2f45b3
-
SSDEEP
49152:KFzUITu6rv7vkceIsWGIgT+pFeawTkvBt:KKfYv4J0wTQB
Malware Config
Extracted
stealc
Extracted
vidar
https://steamcommunity.com/profiles/76561199689717899
https://t.me/copterwin
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Signatures
-
Detect Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2452-80-0x0000000000400000-0x0000000000646000-memory.dmp family_vidar_v7 behavioral1/memory/2452-305-0x0000000000400000-0x0000000000646000-memory.dmp family_vidar_v7 -
Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2452-305-0x0000000000400000-0x0000000000646000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs -
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2452-305-0x0000000000400000-0x0000000000646000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs -
Detects Windows executables referencing non-Windows User-Agents 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2452-80-0x0000000000400000-0x0000000000646000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2452-305-0x0000000000400000-0x0000000000646000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2452-305-0x0000000000400000-0x0000000000646000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2452-80-0x0000000000400000-0x0000000000646000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2452-305-0x0000000000400000-0x0000000000646000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL -
Detects executables containing potential Windows Defender anti-emulation checks 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2452-80-0x0000000000400000-0x0000000000646000-memory.dmp INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation behavioral1/memory/2452-305-0x0000000000400000-0x0000000000646000-memory.dmp INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation -
Downloads MZ/PE file
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exedescription pid process target process PID 2156 set thread context of 2452 2156 484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exe MSBuild.exe -
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MSBuild.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
MSBuild.exepid process 2452 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exedescription pid process Token: SeDebugPrivilege 2156 484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exedescription pid process target process PID 2156 wrote to memory of 2452 2156 484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exe MSBuild.exe PID 2156 wrote to memory of 2452 2156 484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exe MSBuild.exe PID 2156 wrote to memory of 2452 2156 484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exe MSBuild.exe PID 2156 wrote to memory of 2452 2156 484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exe MSBuild.exe PID 2156 wrote to memory of 2452 2156 484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exe MSBuild.exe PID 2156 wrote to memory of 2452 2156 484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exe MSBuild.exe PID 2156 wrote to memory of 2452 2156 484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exe MSBuild.exe PID 2156 wrote to memory of 2452 2156 484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exe MSBuild.exe PID 2156 wrote to memory of 2452 2156 484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exe MSBuild.exe PID 2156 wrote to memory of 2452 2156 484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exe"C:\Users\Admin\AppData\Local\Temp\484de446e05081a326b443adf561111d8d550e0309639007eae2e4c8bdee436b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d16ed7356466732ef6bef61c370649eb
SHA1ea1fccb97c372371eaeefc40acbb32b9c360d095
SHA2568f92956637c621526f233e2d57c6ccf2e1d92be9db2b3adf80b489d832c14953
SHA51249b7ba66e39914f272aea22312bd60f9aabd8b39a5889640c1da7d3901359cb2806494b45ed0065bb9cd6b9babefc94053b3706d4c0036d0f5a58e84bf8b7695
-
C:\Users\Admin\AppData\Local\Temp\Tar19AF.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
memory/2156-58-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-14-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-52-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-6-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-8-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-10-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-12-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-54-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-16-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-18-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-22-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-24-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-56-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-20-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-28-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-34-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-64-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-62-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-60-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-0-0x000000007469E000-0x000000007469F000-memory.dmpFilesize
4KB
-
memory/2156-26-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-4-0x0000000000510000-0x000000000052C000-memory.dmpFilesize
112KB
-
memory/2156-5-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-50-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-48-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-46-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-44-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-43-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-40-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-38-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-36-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-65-0x0000000074690000-0x0000000074D7E000-memory.dmpFilesize
6.9MB
-
memory/2156-32-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-30-0x0000000000510000-0x0000000000525000-memory.dmpFilesize
84KB
-
memory/2156-1-0x0000000001170000-0x0000000001422000-memory.dmpFilesize
2.7MB
-
memory/2156-2-0x0000000001080000-0x0000000001118000-memory.dmpFilesize
608KB
-
memory/2156-3-0x0000000074690000-0x0000000074D7E000-memory.dmpFilesize
6.9MB
-
memory/2156-81-0x0000000074690000-0x0000000074D7E000-memory.dmpFilesize
6.9MB
-
memory/2452-80-0x0000000000400000-0x0000000000646000-memory.dmpFilesize
2.3MB
-
memory/2452-66-0x0000000000400000-0x0000000000646000-memory.dmpFilesize
2.3MB
-
memory/2452-68-0x0000000000400000-0x0000000000646000-memory.dmpFilesize
2.3MB
-
memory/2452-305-0x0000000000400000-0x0000000000646000-memory.dmpFilesize
2.3MB