Malware Analysis Report

2024-11-16 13:47

Sample ID 240628-sdaz4avejc
Target Setup.exe.vir
SHA256 c63d002506855885ef330524e7284a9c4b01ddb78f05db74f2dbfe6ab905190d
Tags
evasion trojan stealc vidar discovery spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c63d002506855885ef330524e7284a9c4b01ddb78f05db74f2dbfe6ab905190d

Threat Level: Known bad

The file Setup.exe.vir was found to be: Known bad.

Malicious Activity Summary

evasion trojan stealc vidar discovery spyware stealer

Detect Vidar Stealer

Vidar

Stealc

Checks computer location settings

Reads data files stored by FTP clients

Loads dropped DLL

Executes dropped EXE

Checks installed software on the system

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Enumerates physical storage devices

Delays execution with timeout.exe

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-28 15:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-28 15:00

Reported

2024-06-28 15:03

Platform

win7-20240611-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

C:\Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe

C:\Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe

Network

N/A

Files

memory/2160-0-0x0000000100000000-0x00000001013EE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\90ffdec7

MD5 9b97e0eeeb2c72848b8364571aa3bea6
SHA1 a976cd15348f6caa5b013d16c7bfb89973601686
SHA256 4f60f0dfbfc9671763edd75f3d0ff83b2782c3cf0ee15531f27890cf42ab0028
SHA512 62ee1d713aed80a8f7282fc9f86c05f4e9be202de8b356728b467b264d7a2715e4cf80ece8a2334f0440834bcf39407dd5fd48a097e5add612e1260a7d54e9c1

memory/2160-6-0x000007FEF6740000-0x000007FEF6898000-memory.dmp

memory/2160-8-0x000007FEF6740000-0x000007FEF6898000-memory.dmp

memory/2160-13-0x000007FEF6758000-0x000007FEF6759000-memory.dmp

memory/2160-14-0x000007FEF6740000-0x000007FEF6898000-memory.dmp

memory/2160-17-0x000007FEF6740000-0x000007FEF6898000-memory.dmp

\Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe

MD5 c047ae13fc1e25bc494b17ca10aa179e
SHA1 e293c7815c0eb8fbc44d60a3e9b27bd91b44b522
SHA256 6c30c8a2e827f48fcfc934dd34fb2cb10acb8747fd11faae085d8ad352c01fbf
SHA512 0cfb96d23b043bcb954cc307f85e5bbc349c0c8a0c6eaa335ea9a8fa19ce65b047f30ed0049562d40880400d4f70e3bb28975d6970f3ae4af6da1ba06e36d48c

\Users\Admin\AppData\Local\Temp\Hq_Control\WebView2Loader.dll

MD5 4a99cb402c0d843b61a83015e0d3d731
SHA1 ac59e7722c85fef8050a715e6f4c3a3e5085d98e
SHA256 4ae3f7437a6991db64eac8e5d2fa02e9edce56ad98aaa273006963fed39548a8
SHA512 1eceb6ff5f53a98e61f21c90de9242e46c9607817eeb7ce77f500a5b225e123ac52b357c7729b334063cd8c8b37c2fbe38e76c1a5ee77244b176aa3e08d7eb18

C:\Users\Admin\AppData\Local\Temp\Hq_Control\perfidy.svg

MD5 d7046da347cd1c24f9af82a326413734
SHA1 a8ecd6cd212e0b866ef9611bf07b6826262da0c4
SHA256 580209f46352f01b832c81a836e72d05819d33502f51bdda6212eefe0b7675d6
SHA512 cd0327dce2c68ee800e204972a88afc30b59e93847a4837fb72ddb2ee0de73e40b8e4450d7f800d50adf239ee0bdf6a1818e21c05677d1893906fc898f59c9de

C:\Users\Admin\AppData\Local\Temp\Hq_Control\butadiene.wav

MD5 67aff9151292ba13adbbdbe84bef05fe
SHA1 c2766299f21528bdf1593ed4f849df1df1b10642
SHA256 09ff3222b2598b793f7081f8c3c20fe071b45cbdba1982997f1ae9c05c20957c
SHA512 a67122d5880dcd411a1143ba76d75604c592018bc90959360ac995b127c7204c93a68815ba823411d6b5e2ae961f76f7b9e6e11e4a572fe7b5aae598e4ff098a

memory/2160-25-0x000007FEF6740000-0x000007FEF6898000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-28 15:00

Reported

2024-06-28 15:03

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Launcher32.exe N/A

Reads data files stored by FTP clients

spyware stealer

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4788 set thread context of 4664 N/A C:\Users\Admin\AppData\Roaming\Hq_Control\JRWeb.exe C:\Windows\SysWOW64\more.com

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\Launcher32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\Launcher32.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Hq_Control\JRWeb.exe N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 232 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe
PID 232 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe
PID 4056 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe C:\Users\Admin\AppData\Roaming\Hq_Control\JRWeb.exe
PID 4056 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe C:\Users\Admin\AppData\Roaming\Hq_Control\JRWeb.exe
PID 4788 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Roaming\Hq_Control\JRWeb.exe C:\Users\Admin\AppData\Roaming\Hq_Control\VRGMYZSSRACXVEJAQJ\Setup.exe
PID 4788 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Roaming\Hq_Control\JRWeb.exe C:\Users\Admin\AppData\Roaming\Hq_Control\VRGMYZSSRACXVEJAQJ\Setup.exe
PID 4788 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Roaming\Hq_Control\JRWeb.exe C:\Users\Admin\AppData\Roaming\Hq_Control\VRGMYZSSRACXVEJAQJ\Setup.exe
PID 4788 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Roaming\Hq_Control\JRWeb.exe C:\Windows\SysWOW64\more.com
PID 4788 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Roaming\Hq_Control\JRWeb.exe C:\Windows\SysWOW64\more.com
PID 4788 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Roaming\Hq_Control\JRWeb.exe C:\Windows\SysWOW64\more.com
PID 4788 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Roaming\Hq_Control\JRWeb.exe C:\Windows\SysWOW64\more.com
PID 4664 wrote to memory of 3484 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\Launcher32.exe
PID 4664 wrote to memory of 3484 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\Launcher32.exe
PID 4664 wrote to memory of 3484 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\Launcher32.exe
PID 4664 wrote to memory of 3484 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\Launcher32.exe
PID 3484 wrote to memory of 3604 N/A C:\Users\Admin\AppData\Local\Temp\Launcher32.exe C:\Windows\SysWOW64\cmd.exe
PID 3484 wrote to memory of 3604 N/A C:\Users\Admin\AppData\Local\Temp\Launcher32.exe C:\Windows\SysWOW64\cmd.exe
PID 3484 wrote to memory of 3604 N/A C:\Users\Admin\AppData\Local\Temp\Launcher32.exe C:\Windows\SysWOW64\cmd.exe
PID 3604 wrote to memory of 456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3604 wrote to memory of 456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3604 wrote to memory of 456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

C:\Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe

C:\Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe

C:\Users\Admin\AppData\Roaming\Hq_Control\JRWeb.exe

C:\Users\Admin\AppData\Roaming\Hq_Control\JRWeb.exe

C:\Users\Admin\AppData\Roaming\Hq_Control\VRGMYZSSRACXVEJAQJ\Setup.exe

C:\Users\Admin\AppData\Roaming\Hq_Control\VRGMYZSSRACXVEJAQJ\Setup.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 2692 -ip 2692

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 880

C:\Windows\SysWOW64\more.com

C:\Windows\SysWOW64\more.com

C:\Users\Admin\AppData\Local\Temp\Launcher32.exe

C:\Users\Admin\AppData\Local\Temp\Launcher32.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Launcher32.exe" & rd /s /q "C:\ProgramData\BFIDGHDBAFIJ" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

memory/232-0-0x00007FF6BF560000-0x00007FF6C094E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dfa2cb22

MD5 9b97e0eeeb2c72848b8364571aa3bea6
SHA1 a976cd15348f6caa5b013d16c7bfb89973601686
SHA256 4f60f0dfbfc9671763edd75f3d0ff83b2782c3cf0ee15531f27890cf42ab0028
SHA512 62ee1d713aed80a8f7282fc9f86c05f4e9be202de8b356728b467b264d7a2715e4cf80ece8a2334f0440834bcf39407dd5fd48a097e5add612e1260a7d54e9c1

memory/232-6-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

memory/232-13-0x00007FFA0EEE8000-0x00007FFA0EEE9000-memory.dmp

memory/232-18-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

memory/232-14-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe

MD5 c047ae13fc1e25bc494b17ca10aa179e
SHA1 e293c7815c0eb8fbc44d60a3e9b27bd91b44b522
SHA256 6c30c8a2e827f48fcfc934dd34fb2cb10acb8747fd11faae085d8ad352c01fbf
SHA512 0cfb96d23b043bcb954cc307f85e5bbc349c0c8a0c6eaa335ea9a8fa19ce65b047f30ed0049562d40880400d4f70e3bb28975d6970f3ae4af6da1ba06e36d48c

memory/232-8-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

memory/232-17-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Hq_Control\WebView2Loader.dll

MD5 4a99cb402c0d843b61a83015e0d3d731
SHA1 ac59e7722c85fef8050a715e6f4c3a3e5085d98e
SHA256 4ae3f7437a6991db64eac8e5d2fa02e9edce56ad98aaa273006963fed39548a8
SHA512 1eceb6ff5f53a98e61f21c90de9242e46c9607817eeb7ce77f500a5b225e123ac52b357c7729b334063cd8c8b37c2fbe38e76c1a5ee77244b176aa3e08d7eb18

C:\Users\Admin\AppData\Local\Temp\Hq_Control\butadiene.wav

MD5 67aff9151292ba13adbbdbe84bef05fe
SHA1 c2766299f21528bdf1593ed4f849df1df1b10642
SHA256 09ff3222b2598b793f7081f8c3c20fe071b45cbdba1982997f1ae9c05c20957c
SHA512 a67122d5880dcd411a1143ba76d75604c592018bc90959360ac995b127c7204c93a68815ba823411d6b5e2ae961f76f7b9e6e11e4a572fe7b5aae598e4ff098a

C:\Users\Admin\AppData\Local\Temp\Hq_Control\perfidy.svg

MD5 d7046da347cd1c24f9af82a326413734
SHA1 a8ecd6cd212e0b866ef9611bf07b6826262da0c4
SHA256 580209f46352f01b832c81a836e72d05819d33502f51bdda6212eefe0b7675d6
SHA512 cd0327dce2c68ee800e204972a88afc30b59e93847a4837fb72ddb2ee0de73e40b8e4450d7f800d50adf239ee0bdf6a1818e21c05677d1893906fc898f59c9de

memory/4056-25-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

memory/4788-37-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

memory/4788-39-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

memory/4788-40-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

C:\Users\Admin\AppData\Roaming\Hq_Control\VRGMYZSSRACXVEJAQJ\Setup.exe

MD5 9f262921a7fbd432c3a694a372caf1b9
SHA1 dfd75a8835a5553d457f4f702c7fe5785227854f
SHA256 56cff82b9e3ee0ed5e74a3e55115e96fd198598be26492cca7b15d9b9023a238
SHA512 cabeaef6132444dc06e7a53332eb58446f7046069044c44b7a27693866a1d66aad7b3ebb5fe7bb79b780548a75b206528f176f5505c574b1c7ad3bcc6fc628b8

memory/232-44-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

memory/4788-45-0x00007FFA0EED0000-0x00007FFA0F042000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\eedb1925

MD5 fb9ffdb066080a1e24bd1876aff23e0a
SHA1 0893bd90254f32e0d4d454f8b185c60389bd469f
SHA256 220577f26d4ae8da5a6affc0a23705cd227d22a9d2c875cd818a9b9736b87f59
SHA512 1de9848f2ff4cd316e3ca84a2255f65397546e65fd5f887731e56197f03a351916df5386211b1c86bcba02bc29861e38ba437c8f470f0bbbb8a3a9c8293d8dab

memory/4664-49-0x00007FFA1DB70000-0x00007FFA1DD65000-memory.dmp

memory/4664-51-0x0000000074B60000-0x0000000074CDB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Launcher32.exe

MD5 de0ea31558536ca7e3164c3cd4578bf5
SHA1 5cc890c3ade653bb1ed1e53dabb0410602ee52df
SHA256 6e599490e164505af796569dce30e18218b179b2b791fe69764892b3ed3e7478
SHA512 c47299cd5f3b4961f423c2ca1fef5a33eb4b0f63dc232af70ef9da39f6f82270406061dd543461de7e47abd1244e26d6190de6035120211b27d4c23f97a25aba

memory/3484-56-0x00007FFA1DB70000-0x00007FFA1DD65000-memory.dmp

memory/3484-57-0x0000000000A00000-0x000000000114B000-memory.dmp

memory/3484-61-0x0000000000A00000-0x000000000114B000-memory.dmp

memory/3484-62-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/3484-74-0x0000000000A00000-0x000000000114B000-memory.dmp