Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    29-06-2024 01:51

General

  • Target

    !!fUlLSetup_3355_P@ssKeys!!/Setup.exe

  • Size

    656.8MB

  • MD5

    a16936abeb9abc4945d6fdd76ecec729

  • SHA1

    a74de976ce3af1db488626afe9796f7f13add504

  • SHA256

    b2300fcaa158d08f4980f4cfe7373848256bd4918384a18e3c32b464add812a7

  • SHA512

    d03704bef171f7815765fb527fa7c1103fdfbdfeaad22eb09b0af893ff1adec9455e7c6629946846be1924e12ac5213f7f467abf0a7276522bccfac3d25f8f44

  • SSDEEP

    196608:doeohPRS9UUoFG2z4wThcbwNq1Af8YOdN6ZLAM4/tS9yS:doeoRao/

Score
10/10

Malware Config

Extracted

Family

vidar

C2

https://t.me/g067n

https://steamcommunity.com/profiles/76561199707802586

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0

Signatures

  • Detect Vidar Stealer 3 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Detects Windows executables referencing non-Windows User-Agents 2 IoCs
  • Loads dropped DLL 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\!!fUlLSetup_3355_P@ssKeys!!\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\!!fUlLSetup_3355_P@ssKeys!!\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Windows\SysWOW64\more.com
      C:\Windows\SysWOW64\more.com
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Users\Admin\AppData\Local\Temp\VIDA.au3
        C:\Users\Admin\AppData\Local\Temp\VIDA.au3
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2660
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 148
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\e748d98e

    Filesize

    1.6MB

    MD5

    e9036df928c31d7ba3f8ed63275a9dc2

    SHA1

    d1effabbdb38682cf73f6ddb5f0170112efe6381

    SHA256

    f2516f2ea49297ceb88651eec0815035cf3961543891571f62a013df3a3400b2

    SHA512

    841cfceda5f9cbbb2689e158918c3c44071928ef6c96f20651b8aeae1211c423a8ff6fd3f4d50b7e9ce01b1cc12bcb020cbe941430376c991521c93ca49afe6d

  • C:\Users\Admin\AppData\Local\Temp\e9a5e509

    Filesize

    1.7MB

    MD5

    259a510140a5ca1fb7d8c620025947c8

    SHA1

    77c23f8083a6872d16f9df3d25d0a7f00d3ab920

    SHA256

    fa920ff6ca68fd1db5d420266474232ec47af7ba185dcc99bc2656f4d88e9963

    SHA512

    ac3d5efec81919d1dd16ad76de24624c8ef8062d04a193336b6e7ed41385a691052f75709b0b0149b06f2310fc8146a6676077b1092ae2bfe6107b40d8692c53

  • \Users\Admin\AppData\Local\Temp\VIDA.au3

    Filesize

    872KB

    MD5

    c56b5f0201a3b3de53e561fe76912bfd

    SHA1

    2a4062e10a5de813f5688221dbeb3f3ff33eb417

    SHA256

    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

    SHA512

    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

  • memory/1688-0-0x0000000000B70000-0x0000000000B71000-memory.dmp

    Filesize

    4KB

  • memory/1688-1-0x0000000000400000-0x0000000000B60000-memory.dmp

    Filesize

    7.4MB

  • memory/1688-7-0x000007FEF6BD0000-0x000007FEF6D28000-memory.dmp

    Filesize

    1.3MB

  • memory/1688-8-0x000007FEF6BE8000-0x000007FEF6BE9000-memory.dmp

    Filesize

    4KB

  • memory/1688-9-0x000007FEF6BD0000-0x000007FEF6D28000-memory.dmp

    Filesize

    1.3MB

  • memory/1688-10-0x000007FEF6BD0000-0x000007FEF6D28000-memory.dmp

    Filesize

    1.3MB

  • memory/2484-17-0x0000000074E9E000-0x0000000074EA0000-memory.dmp

    Filesize

    8KB

  • memory/2484-16-0x0000000074E90000-0x0000000075004000-memory.dmp

    Filesize

    1.5MB

  • memory/2484-21-0x0000000074E90000-0x0000000075004000-memory.dmp

    Filesize

    1.5MB

  • memory/2484-14-0x0000000077500000-0x00000000776A9000-memory.dmp

    Filesize

    1.7MB

  • memory/2484-25-0x0000000074E90000-0x0000000075004000-memory.dmp

    Filesize

    1.5MB

  • memory/2484-36-0x0000000074E9E000-0x0000000074EA0000-memory.dmp

    Filesize

    8KB

  • memory/2660-24-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2660-23-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2660-27-0x00000000005F0000-0x0000000000839000-memory.dmp

    Filesize

    2.3MB

  • memory/2660-34-0x00000000005F0000-0x0000000000839000-memory.dmp

    Filesize

    2.3MB

  • memory/2660-37-0x00000000005F0000-0x0000000000839000-memory.dmp

    Filesize

    2.3MB