Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1#Nḙw_PC�...!!.rar
windows7-x64
3#Nḙw_PC�...!!.rar
windows10-2004-x64
3flutter_windows.dll
windows7-x64
1flutter_windows.dll
windows10-2004-x64
1msvcp140.dll
windows7-x64
1msvcp140.dll
windows10-2004-x64
1setup.exe
windows7-x64
10setup.exe
windows10-2004-x64
10tray_manag...in.dll
windows7-x64
1tray_manag...in.dll
windows10-2004-x64
1url_launch...in.dll
windows7-x64
1url_launch...in.dll
windows10-2004-x64
1vcruntime140.dll
windows7-x64
1vcruntime140.dll
windows10-2004-x64
1vcruntime140_1.dll
windows7-x64
1vcruntime140_1.dll
windows10-2004-x64
1vcruntime140_app.dll
windows7-x64
1vcruntime140_app.dll
windows10-2004-x64
3windows_si...in.dll
windows7-x64
1windows_si...in.dll
windows10-2004-x64
1x86/HDHelp...1].exe
windows7-x64
1x86/HDHelp...1].exe
windows10-2004-x64
1x86/NvSter...1].exe
windows7-x64
1x86/NvSter...1].exe
windows10-2004-x64
3x86/VSLaun...1].exe
windows7-x64
1x86/VSLaun...1].exe
windows10-2004-x64
1x86/api-ms...-1.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1x86/api-ms...-0.dll
windows10-2004-x64
1Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/06/2024, 12:05
Static task
static1
Behavioral task
behavioral1
Sample
#Nḙw_PCŜétup-44286-Pa$$wrD!!.rar
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
#Nḙw_PCŜétup-44286-Pa$$wrD!!.rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
flutter_windows.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
flutter_windows.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
msvcp140.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
msvcp140.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
setup.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
setup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
tray_manager_plugin.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
tray_manager_plugin.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
url_launcher_windows_plugin.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
url_launcher_windows_plugin.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
vcruntime140.dll
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
vcruntime140.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
vcruntime140_1.dll
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
vcruntime140_1.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
vcruntime140_app.dll
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
vcruntime140_app.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
windows_single_instance_plugin.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
windows_single_instance_plugin.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral21
Sample
x86/HDHelper_[0MB]_[1].exe
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
x86/HDHelper_[0MB]_[1].exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
x86/NvStereoUtilityOGL_[1MB]_[1].exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
x86/NvStereoUtilityOGL_[1MB]_[1].exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
x86/VSLauncher_[0MB]_[1].exe
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
x86/VSLauncher_[0MB]_[1].exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
x86/api-ms-win-core-processthreads-l1-1-1.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral28
Sample
x86/api-ms-win-core-profile-l1-1-0.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
x86/api-ms-win-core-rtlsupport-l1-1-0.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral30
Sample
x86/api-ms-win-core-string-l1-1-0.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
x86/api-ms-win-core-synch-l1-1-0.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral32
Sample
x86/api-ms-win-core-synch-l1-2-0.dll
Resource
win10v2004-20240508-en
General
-
Target
setup.exe
-
Size
316KB
-
MD5
c637e5ecf625b72f4bef9d28cd81d612
-
SHA1
a2c1329d290e508ee9fd0eb81e7f25d57e450f8c
-
SHA256
111c56593668be63e1e0c79a2d33d9e2d49cdf0c5100663c72045bc6b76e9fe6
-
SHA512
727d78bab4fab3674eec92ca5f07df6a0095ab3b973dd227c599c70e8493592bb53bb9208cc6270713283ef0065acfad3203ddcf4dcb6d43f8727f09ceaaf2e4
-
SSDEEP
6144:VzsRSKkhKKXDD2mTLGxelHJ+SBae3VFpSX:6VkhZWEGxelH0SBtfpS
Malware Config
Extracted
stealc
Signatures
-
Detect Vidar Stealer 2 IoCs
resource yara_rule behavioral8/memory/5024-22-0x0000000000C20000-0x000000000136B000-memory.dmp family_vidar_v7 behavioral8/memory/5024-37-0x0000000000C20000-0x000000000136B000-memory.dmp family_vidar_v7 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation coml.au3 -
Loads dropped DLL 1 IoCs
pid Process 5024 coml.au3 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2544 set thread context of 2908 2544 setup.exe 83 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString coml.au3 -
Delays execution with timeout.exe 1 IoCs
pid Process 4792 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2544 setup.exe 2544 setup.exe 2908 netsh.exe 2908 netsh.exe 5024 coml.au3 5024 coml.au3 -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2544 setup.exe 2908 netsh.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2544 wrote to memory of 2908 2544 setup.exe 83 PID 2544 wrote to memory of 2908 2544 setup.exe 83 PID 2544 wrote to memory of 2908 2544 setup.exe 83 PID 2544 wrote to memory of 2908 2544 setup.exe 83 PID 2908 wrote to memory of 5024 2908 netsh.exe 85 PID 2908 wrote to memory of 5024 2908 netsh.exe 85 PID 2908 wrote to memory of 5024 2908 netsh.exe 85 PID 2908 wrote to memory of 5024 2908 netsh.exe 85 PID 2908 wrote to memory of 5024 2908 netsh.exe 85 PID 5024 wrote to memory of 5000 5024 coml.au3 87 PID 5024 wrote to memory of 5000 5024 coml.au3 87 PID 5024 wrote to memory of 5000 5024 coml.au3 87 PID 5000 wrote to memory of 4792 5000 cmd.exe 89 PID 5000 wrote to memory of 4792 5000 cmd.exe 89 PID 5000 wrote to memory of 4792 5000 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\coml.au3C:\Users\Admin\AppData\Local\Temp\coml.au33⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\coml.au3" & rd /s /q "C:\ProgramData\HIDAFHDHCBGD" & exit4⤵
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\timeout.exetimeout /t 105⤵
- Delays execution with timeout.exe
PID:4792
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.8MB
MD5cc815556c62e16519b5475fbf2686000
SHA1cbaef1952bfa16aa0b4ee7d577e59fb23bebfead
SHA256129b592cf0a6bbc8dc042d486958bd34739cde930f55444c66451acf50808c48
SHA512f3a0b4781cdd7f86e0c33f299fa5e3bad24aced1d88021e96f046c0285bb19257cb23b3488aa477a1e2e2094b7d38e02bab86c721c1c22fece74d27dc02045b5
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c