Overview
overview
10Static
static
1Setup.exe
windows7-x64
10Setup.exe
windows10-1703-x64
10Setup.exe
windows10-2004-x64
10Setup.exe
windows11-21h2-x64
10Setup.exe
android-9-x86
Setup.exe
android-10-x64
Setup.exe
android-11-x64
Setup.exe
macos-10.15-amd64
1Setup.exe
ubuntu-18.04-amd64
Setup.exe
debian-9-armhf
Setup.exe
debian-9-mips
Setup.exe
debian-9-mipsel
Analysis
-
max time kernel
131s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
29-06-2024 02:51
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
Setup.exe
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral6
Sample
Setup.exe
Resource
android-x64-20240624-en
Behavioral task
behavioral7
Sample
Setup.exe
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral8
Sample
Setup.exe
Resource
macos-20240611-en
Behavioral task
behavioral9
Sample
Setup.exe
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral10
Sample
Setup.exe
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral11
Sample
Setup.exe
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral12
Sample
Setup.exe
Resource
debian9-mipsel-20240611-en
General
-
Target
Setup.exe
-
Size
707.9MB
-
MD5
b25431a1b7b821eef6f77698c18fabb7
-
SHA1
8986dac902bc4827925550dab54d522c9d508d50
-
SHA256
b81deb9f7a113389c170b54921cd8ec33216e7819b91b3a413e2ee79ad592434
-
SHA512
474e6f1ad5eb02557f3046e6f23f176bca72248617a2b6c4b9378ac18b72e32175a8976e3e8d106c454d12b946e920aa1048e374b701c218f87df1d335d15f27
-
SSDEEP
196608:P/tv60Dx802nynypt/G0o55XGyPkqPVGEt3eaie54JngocFYKAAPIVelZ3wTVCZU:tBx802nygh6WwZjeaF549X
Malware Config
Extracted
stealc
Extracted
vidar
10.1
bd7a7ef85507e39998176b88b253bdb9
https://t.me/memve4erin
https://steamcommunity.com/profiles/76561199699680841
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0
Signatures
-
Detect Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1016-70-0x0000000000EF0000-0x000000000163B000-memory.dmp family_vidar_v7 behavioral2/memory/1016-74-0x0000000000EF0000-0x000000000163B000-memory.dmp family_vidar_v7 behavioral2/memory/1016-83-0x0000000000EF0000-0x000000000163B000-memory.dmp family_vidar_v7 -
Loads dropped DLL 3 IoCs
Processes:
coml.au3pid process 1016 coml.au3 1016 coml.au3 1016 coml.au3 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid process target process PID 5064 set thread context of 5028 5064 Setup.exe netsh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
coml.au3description ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString coml.au3 -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4540 timeout.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
Setup.exenetsh.execoml.au3pid process 5064 Setup.exe 5064 Setup.exe 5028 netsh.exe 5028 netsh.exe 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 1016 coml.au3 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Setup.exenetsh.exepid process 5064 Setup.exe 5028 netsh.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Setup.exenetsh.execoml.au3cmd.exedescription pid process target process PID 5064 wrote to memory of 5028 5064 Setup.exe netsh.exe PID 5064 wrote to memory of 5028 5064 Setup.exe netsh.exe PID 5064 wrote to memory of 5028 5064 Setup.exe netsh.exe PID 5064 wrote to memory of 5028 5064 Setup.exe netsh.exe PID 5028 wrote to memory of 1016 5028 netsh.exe coml.au3 PID 5028 wrote to memory of 1016 5028 netsh.exe coml.au3 PID 5028 wrote to memory of 1016 5028 netsh.exe coml.au3 PID 5028 wrote to memory of 1016 5028 netsh.exe coml.au3 PID 5028 wrote to memory of 1016 5028 netsh.exe coml.au3 PID 1016 wrote to memory of 4668 1016 coml.au3 cmd.exe PID 1016 wrote to memory of 4668 1016 coml.au3 cmd.exe PID 1016 wrote to memory of 4668 1016 coml.au3 cmd.exe PID 4668 wrote to memory of 4540 4668 cmd.exe timeout.exe PID 4668 wrote to memory of 4540 4668 cmd.exe timeout.exe PID 4668 wrote to memory of 4540 4668 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Event Triggered Execution: Netsh Helper DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\coml.au3C:\Users\Admin\AppData\Local\Temp\coml.au33⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AAKJEGCFBGDH" & exit4⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\timeout.exetimeout /t 105⤵
- Delays execution with timeout.exe
PID:4540
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5a37ee36b536409056a86f50e67777dd7
SHA11cafa159292aa736fc595fc04e16325b27cd6750
SHA2568934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA5123a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
-
Filesize
439KB
MD55ff1fca37c466d6723ec67be93b51442
SHA134cc4e158092083b13d67d6d2bc9e57b798a303b
SHA2565136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA5124802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546
-
Filesize
251KB
MD54e52d739c324db8225bd9ab2695f262f
SHA171c3da43dc5a0d2a1941e874a6d015a071783889
SHA25674ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA5122d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6
-
Filesize
6.8MB
MD579d6cd0a6fa70df57844f76a30cfe8cf
SHA1d44d41bc8314a68800714af798080bbd6971c696
SHA2563ee5c71955bd714b73ca800d3b5b840427e5d8bcd0e224fe202663c17d7413a7
SHA5123209fc4ba40e585960ddbc5e6c01130a2a1ccee5202847ebca92de93d987a4e8159ab3fbbf50f3fb5067ad2071898cf521efafc6d12f03eb4562c169679c1908
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
6.8MB
MD5957edcb00ce0b522499f6c799ea11053
SHA1b1c91d93701d206820e45118e0df50d34790d27d
SHA256e4456eea3e2fca53bc2a06fd247eba74bf668c39069d5c821d082ef7dfa03f5d
SHA512167cb1c01f28bc40f85d0d8f895346d147a286811550142ebdf659cc4ba92f015d4def386d58adf4c48b1946ee31ddd8dcbef50ba09533889e9ad161c9867eb6
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571