Overview
overview
10Static
static
1Setup.exe
windows7-x64
10Setup.exe
windows10-1703-x64
10Setup.exe
windows10-2004-x64
10Setup.exe
windows11-21h2-x64
10Setup.exe
android-9-x86
Setup.exe
android-10-x64
Setup.exe
android-11-x64
Setup.exe
macos-10.15-amd64
1Setup.exe
ubuntu-18.04-amd64
Setup.exe
debian-9-armhf
Setup.exe
debian-9-mips
Setup.exe
debian-9-mipsel
Analysis
-
max time kernel
143s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 02:51
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
Setup.exe
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral6
Sample
Setup.exe
Resource
android-x64-20240624-en
Behavioral task
behavioral7
Sample
Setup.exe
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral8
Sample
Setup.exe
Resource
macos-20240611-en
Behavioral task
behavioral9
Sample
Setup.exe
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral10
Sample
Setup.exe
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral11
Sample
Setup.exe
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral12
Sample
Setup.exe
Resource
debian9-mipsel-20240611-en
General
-
Target
Setup.exe
-
Size
707.9MB
-
MD5
b25431a1b7b821eef6f77698c18fabb7
-
SHA1
8986dac902bc4827925550dab54d522c9d508d50
-
SHA256
b81deb9f7a113389c170b54921cd8ec33216e7819b91b3a413e2ee79ad592434
-
SHA512
474e6f1ad5eb02557f3046e6f23f176bca72248617a2b6c4b9378ac18b72e32175a8976e3e8d106c454d12b946e920aa1048e374b701c218f87df1d335d15f27
-
SSDEEP
196608:P/tv60Dx802nynypt/G0o55XGyPkqPVGEt3eaie54JngocFYKAAPIVelZ3wTVCZU:tBx802nygh6WwZjeaF549X
Malware Config
Extracted
stealc
Extracted
vidar
10.1
bd7a7ef85507e39998176b88b253bdb9
https://t.me/memve4erin
https://steamcommunity.com/profiles/76561199699680841
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0
Signatures
-
Detect Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2644-25-0x0000000000670000-0x0000000000DBB000-memory.dmp family_vidar_v7 behavioral1/memory/2644-32-0x0000000000670000-0x0000000000DBB000-memory.dmp family_vidar_v7 -
Loads dropped DLL 7 IoCs
Processes:
netsh.execoml.au3WerFault.exepid process 300 netsh.exe 2644 coml.au3 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid process target process PID 876 set thread context of 300 876 Setup.exe netsh.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1324 2644 WerFault.exe coml.au3 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Setup.exenetsh.exepid process 876 Setup.exe 876 Setup.exe 300 netsh.exe 300 netsh.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Setup.exenetsh.exepid process 876 Setup.exe 300 netsh.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Setup.exenetsh.execoml.au3description pid process target process PID 876 wrote to memory of 300 876 Setup.exe netsh.exe PID 876 wrote to memory of 300 876 Setup.exe netsh.exe PID 876 wrote to memory of 300 876 Setup.exe netsh.exe PID 876 wrote to memory of 300 876 Setup.exe netsh.exe PID 876 wrote to memory of 300 876 Setup.exe netsh.exe PID 300 wrote to memory of 2644 300 netsh.exe coml.au3 PID 300 wrote to memory of 2644 300 netsh.exe coml.au3 PID 300 wrote to memory of 2644 300 netsh.exe coml.au3 PID 300 wrote to memory of 2644 300 netsh.exe coml.au3 PID 300 wrote to memory of 2644 300 netsh.exe coml.au3 PID 300 wrote to memory of 2644 300 netsh.exe coml.au3 PID 2644 wrote to memory of 1324 2644 coml.au3 WerFault.exe PID 2644 wrote to memory of 1324 2644 coml.au3 WerFault.exe PID 2644 wrote to memory of 1324 2644 coml.au3 WerFault.exe PID 2644 wrote to memory of 1324 2644 coml.au3 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Users\Admin\AppData\Local\Temp\coml.au3C:\Users\Admin\AppData\Local\Temp\coml.au33⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1484⤵
- Loads dropped DLL
- Program crash
PID:1324
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.8MB
MD5957edcb00ce0b522499f6c799ea11053
SHA1b1c91d93701d206820e45118e0df50d34790d27d
SHA256e4456eea3e2fca53bc2a06fd247eba74bf668c39069d5c821d082ef7dfa03f5d
SHA512167cb1c01f28bc40f85d0d8f895346d147a286811550142ebdf659cc4ba92f015d4def386d58adf4c48b1946ee31ddd8dcbef50ba09533889e9ad161c9867eb6
-
Filesize
6.8MB
MD570d544ea90499a5404a8298a98f5a355
SHA1be8ce8d3791656ed8833e9884b1584231bfee8e6
SHA2569a03bcf5e6c9e1caf20f8773e9438acc627e797b23db8ef6d27704d4b975ac34
SHA5120715a68babaf4e18f3b2522b657c728c2a03af2ade1cbf1479d477914794c64ce765139fd5786d821c3e7b1a302d7deb230ea94a2dfa59cdd8742a7abfb0e331
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c