Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 14:48
Static task
static1
Behavioral task
behavioral1
Sample
207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe
Resource
win10v2004-20240508-en
General
-
Target
207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe
-
Size
4.4MB
-
MD5
4a8099ca44ad78fa5414bab4f54ba030
-
SHA1
ad1e9ee328d7eb870ebdaf9cf592a183f838f459
-
SHA256
207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342
-
SHA512
b1f905210d372c8352c07ea6c27bd71f12f7ee3a1e40375925bc6cb295b08d07d5bd9407e4da6e7d303a0951fb19e060a652951bfdf67f1151f19720e8698d03
-
SSDEEP
49152:0fhvX07qcsIUv5z95W+diSQJAoCWFf4z6X5MS/tl3odglPCpgVS84OH:+hc7qcvWzE4OX53C+V5r
Malware Config
Extracted
vidar
https://t.me/g067n
https://steamcommunity.com/profiles/76561199707802586
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0
Signatures
-
Detect Vidar Stealer 6 IoCs
resource yara_rule behavioral1/memory/4092-70-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral1/memory/4092-68-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral1/memory/4092-73-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral1/memory/4092-74-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral1/memory/4092-75-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral1/memory/4092-77-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral1/memory/3040-1-0x0000000000AC0000-0x0000000000F26000-memory.dmp net_reactor -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3040 set thread context of 4092 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 83 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MSBuild.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSBuild.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1052 timeout.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 4092 MSBuild.exe 4092 MSBuild.exe 4092 MSBuild.exe 4092 MSBuild.exe 4092 MSBuild.exe 4092 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3040 wrote to memory of 224 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 80 PID 3040 wrote to memory of 224 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 80 PID 3040 wrote to memory of 224 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 80 PID 3040 wrote to memory of 216 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 81 PID 3040 wrote to memory of 216 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 81 PID 3040 wrote to memory of 216 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 81 PID 3040 wrote to memory of 2656 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 82 PID 3040 wrote to memory of 2656 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 82 PID 3040 wrote to memory of 2656 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 82 PID 3040 wrote to memory of 4092 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 83 PID 3040 wrote to memory of 4092 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 83 PID 3040 wrote to memory of 4092 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 83 PID 3040 wrote to memory of 4092 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 83 PID 3040 wrote to memory of 4092 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 83 PID 3040 wrote to memory of 4092 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 83 PID 3040 wrote to memory of 4092 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 83 PID 3040 wrote to memory of 4092 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 83 PID 3040 wrote to memory of 4092 3040 207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe 83 PID 4092 wrote to memory of 4816 4092 MSBuild.exe 85 PID 4092 wrote to memory of 4816 4092 MSBuild.exe 85 PID 4092 wrote to memory of 4816 4092 MSBuild.exe 85 PID 4816 wrote to memory of 1052 4816 cmd.exe 87 PID 4816 wrote to memory of 1052 4816 cmd.exe 87 PID 4816 wrote to memory of 1052 4816 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe"C:\Users\Admin\AppData\Local\Temp\207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:224
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:216
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2656
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\FCAFIJJJKEGI" & exit3⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- Delays execution with timeout.exe
PID:1052
-
-
-