Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-06-2024 01:51

General

  • Target

    !!fUlLSetup_3355_P@ssKeys!!/Setup.exe

  • Size

    656.8MB

  • MD5

    a16936abeb9abc4945d6fdd76ecec729

  • SHA1

    a74de976ce3af1db488626afe9796f7f13add504

  • SHA256

    b2300fcaa158d08f4980f4cfe7373848256bd4918384a18e3c32b464add812a7

  • SHA512

    d03704bef171f7815765fb527fa7c1103fdfbdfeaad22eb09b0af893ff1adec9455e7c6629946846be1924e12ac5213f7f467abf0a7276522bccfac3d25f8f44

  • SSDEEP

    196608:doeohPRS9UUoFG2z4wThcbwNq1Af8YOdN6ZLAM4/tS9yS:doeoRao/

Malware Config

Extracted

Family

vidar

C2

https://t.me/g067n

https://steamcommunity.com/profiles/76561199707802586

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0

Signatures

  • Detect Vidar Stealer 4 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 3 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\!!fUlLSetup_3355_P@ssKeys!!\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\!!fUlLSetup_3355_P@ssKeys!!\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3140
    • C:\Windows\SysWOW64\more.com
      C:\Windows\SysWOW64\more.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\Users\Admin\AppData\Local\Temp\VIDA.au3
        C:\Users\Admin\AppData\Local\Temp\VIDA.au3
        3⤵
        • Checks computer location settings
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4208

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\VIDA.au3

    Filesize

    872KB

    MD5

    c56b5f0201a3b3de53e561fe76912bfd

    SHA1

    2a4062e10a5de813f5688221dbeb3f3ff33eb417

    SHA256

    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

    SHA512

    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

  • C:\Users\Admin\AppData\Local\Temp\ace27665

    Filesize

    1.6MB

    MD5

    e9036df928c31d7ba3f8ed63275a9dc2

    SHA1

    d1effabbdb38682cf73f6ddb5f0170112efe6381

    SHA256

    f2516f2ea49297ceb88651eec0815035cf3961543891571f62a013df3a3400b2

    SHA512

    841cfceda5f9cbbb2689e158918c3c44071928ef6c96f20651b8aeae1211c423a8ff6fd3f4d50b7e9ce01b1cc12bcb020cbe941430376c991521c93ca49afe6d

  • C:\Users\Admin\AppData\Local\Temp\afbfc86b

    Filesize

    1.7MB

    MD5

    a5c36660c5d69ecd8e796b65843f682e

    SHA1

    10e7176a897a1268d12686eccb0acc11553da82e

    SHA256

    61c8831a1d3b915cff6e933602881e1beeeca08d6bc87bfcfee1506cbcb52769

    SHA512

    fc804dbdef88ffd223259ecbf8b21832914e38a88d8e6a55fa08cf613fe25e420f333a1b291bc8e75b623436528d1457b106dd92aaf588b36380b4ecbe9f1019

  • memory/3140-1-0x0000000000400000-0x0000000000B60000-memory.dmp

    Filesize

    7.4MB

  • memory/3140-7-0x00007FFD08960000-0x00007FFD08AD2000-memory.dmp

    Filesize

    1.4MB

  • memory/3140-8-0x00007FFD08978000-0x00007FFD08979000-memory.dmp

    Filesize

    4KB

  • memory/3140-9-0x00007FFD08960000-0x00007FFD08AD2000-memory.dmp

    Filesize

    1.4MB

  • memory/3140-10-0x00007FFD08960000-0x00007FFD08AD2000-memory.dmp

    Filesize

    1.4MB

  • memory/3140-0-0x00000000028C0000-0x00000000028C1000-memory.dmp

    Filesize

    4KB

  • memory/4208-27-0x00007FFD17AF0000-0x00007FFD17CE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4208-26-0x0000000000C90000-0x0000000000ED9000-memory.dmp

    Filesize

    2.3MB

  • memory/4208-37-0x0000000000C90000-0x0000000000ED9000-memory.dmp

    Filesize

    2.3MB

  • memory/4208-41-0x000000001D5A0000-0x000000001D7FF000-memory.dmp

    Filesize

    2.4MB

  • memory/4208-82-0x0000000000C90000-0x0000000000ED9000-memory.dmp

    Filesize

    2.3MB

  • memory/4208-84-0x0000000000C90000-0x0000000000ED9000-memory.dmp

    Filesize

    2.3MB

  • memory/4972-16-0x00000000756E0000-0x000000007585B000-memory.dmp

    Filesize

    1.5MB

  • memory/4972-18-0x00000000756E0000-0x000000007585B000-memory.dmp

    Filesize

    1.5MB

  • memory/4972-23-0x00000000756E0000-0x000000007585B000-memory.dmp

    Filesize

    1.5MB

  • memory/4972-17-0x00000000756EE000-0x00000000756F0000-memory.dmp

    Filesize

    8KB

  • memory/4972-14-0x00007FFD17AF0000-0x00007FFD17CE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4972-83-0x00000000756EE000-0x00000000756F0000-memory.dmp

    Filesize

    8KB