Overview
overview
10Static
static
1Setup.exe
windows7-x64
10Setup.exe
windows10-1703-x64
10Setup.exe
windows10-2004-x64
10Setup.exe
windows11-21h2-x64
10Setup.exe
android-9-x86
Setup.exe
android-10-x64
Setup.exe
android-11-x64
Setup.exe
macos-10.15-amd64
1Setup.exe
ubuntu-18.04-amd64
Setup.exe
debian-9-armhf
Setup.exe
debian-9-mips
Setup.exe
debian-9-mipsel
Analysis
-
max time kernel
133s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 02:51
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
Setup.exe
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral6
Sample
Setup.exe
Resource
android-x64-20240624-en
Behavioral task
behavioral7
Sample
Setup.exe
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral8
Sample
Setup.exe
Resource
macos-20240611-en
Behavioral task
behavioral9
Sample
Setup.exe
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral10
Sample
Setup.exe
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral11
Sample
Setup.exe
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral12
Sample
Setup.exe
Resource
debian9-mipsel-20240611-en
General
-
Target
Setup.exe
-
Size
707.9MB
-
MD5
b25431a1b7b821eef6f77698c18fabb7
-
SHA1
8986dac902bc4827925550dab54d522c9d508d50
-
SHA256
b81deb9f7a113389c170b54921cd8ec33216e7819b91b3a413e2ee79ad592434
-
SHA512
474e6f1ad5eb02557f3046e6f23f176bca72248617a2b6c4b9378ac18b72e32175a8976e3e8d106c454d12b946e920aa1048e374b701c218f87df1d335d15f27
-
SSDEEP
196608:P/tv60Dx802nynypt/G0o55XGyPkqPVGEt3eaie54JngocFYKAAPIVelZ3wTVCZU:tBx802nygh6WwZjeaF549X
Malware Config
Extracted
stealc
Extracted
vidar
10.1
bd7a7ef85507e39998176b88b253bdb9
https://t.me/memve4erin
https://steamcommunity.com/profiles/76561199699680841
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0
Signatures
-
Detect Vidar Stealer 6 IoCs
Processes:
resource yara_rule behavioral3/memory/3000-21-0x0000000001200000-0x000000000194B000-memory.dmp family_vidar_v7 behavioral3/memory/3000-26-0x0000000001200000-0x000000000194B000-memory.dmp family_vidar_v7 behavioral3/memory/3000-97-0x0000000001200000-0x000000000194B000-memory.dmp family_vidar_v7 behavioral3/memory/3000-103-0x0000000001200000-0x000000000194B000-memory.dmp family_vidar_v7 behavioral3/memory/3000-118-0x0000000001200000-0x000000000194B000-memory.dmp family_vidar_v7 behavioral3/memory/3000-119-0x0000000001200000-0x000000000194B000-memory.dmp family_vidar_v7 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
coml.au3description ioc process Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation coml.au3 -
Loads dropped DLL 3 IoCs
Processes:
coml.au3pid process 3000 coml.au3 3000 coml.au3 3000 coml.au3 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid process target process PID 1904 set thread context of 2160 1904 Setup.exe netsh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
coml.au3description ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString coml.au3 -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4548 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
Setup.exenetsh.execoml.au3pid process 1904 Setup.exe 1904 Setup.exe 1904 Setup.exe 2160 netsh.exe 2160 netsh.exe 2160 netsh.exe 2160 netsh.exe 3000 coml.au3 3000 coml.au3 3000 coml.au3 3000 coml.au3 3000 coml.au3 3000 coml.au3 3000 coml.au3 3000 coml.au3 3000 coml.au3 3000 coml.au3 3000 coml.au3 3000 coml.au3 3000 coml.au3 3000 coml.au3 3000 coml.au3 3000 coml.au3 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Setup.exenetsh.exepid process 1904 Setup.exe 2160 netsh.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Setup.exenetsh.execoml.au3cmd.exedescription pid process target process PID 1904 wrote to memory of 2160 1904 Setup.exe netsh.exe PID 1904 wrote to memory of 2160 1904 Setup.exe netsh.exe PID 1904 wrote to memory of 2160 1904 Setup.exe netsh.exe PID 1904 wrote to memory of 2160 1904 Setup.exe netsh.exe PID 2160 wrote to memory of 3000 2160 netsh.exe coml.au3 PID 2160 wrote to memory of 3000 2160 netsh.exe coml.au3 PID 2160 wrote to memory of 3000 2160 netsh.exe coml.au3 PID 2160 wrote to memory of 3000 2160 netsh.exe coml.au3 PID 2160 wrote to memory of 3000 2160 netsh.exe coml.au3 PID 3000 wrote to memory of 3700 3000 coml.au3 cmd.exe PID 3000 wrote to memory of 3700 3000 coml.au3 cmd.exe PID 3000 wrote to memory of 3700 3000 coml.au3 cmd.exe PID 3700 wrote to memory of 4548 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 4548 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 4548 3700 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Event Triggered Execution: Netsh Helper DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\coml.au3C:\Users\Admin\AppData\Local\Temp\coml.au33⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\CBGCBKFBGIII" & exit4⤵
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\timeout.exetimeout /t 105⤵
- Delays execution with timeout.exe
PID:4548
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3060,i,3595107284059830391,18018199024659337217,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:81⤵PID:1052
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=3612,i,3595107284059830391,18018199024659337217,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:31⤵PID:4100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5a37ee36b536409056a86f50e67777dd7
SHA11cafa159292aa736fc595fc04e16325b27cd6750
SHA2568934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA5123a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
439KB
MD55ff1fca37c466d6723ec67be93b51442
SHA134cc4e158092083b13d67d6d2bc9e57b798a303b
SHA2565136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA5124802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
251KB
MD54e52d739c324db8225bd9ab2695f262f
SHA171c3da43dc5a0d2a1941e874a6d015a071783889
SHA25674ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA5122d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
6.8MB
MD5957edcb00ce0b522499f6c799ea11053
SHA1b1c91d93701d206820e45118e0df50d34790d27d
SHA256e4456eea3e2fca53bc2a06fd247eba74bf668c39069d5c821d082ef7dfa03f5d
SHA512167cb1c01f28bc40f85d0d8f895346d147a286811550142ebdf659cc4ba92f015d4def386d58adf4c48b1946ee31ddd8dcbef50ba09533889e9ad161c9867eb6
-
Filesize
6.8MB
MD51d88c4434779a424cdc3383613851f80
SHA1cc0b88adab15e067d943b4551f8f2af79f205ac3
SHA256236206c5cf0e197614ad6663422da4d07a1720c3de1309b03c74367277995a00
SHA51201dd009b6e69ad5a9e376c18148a6a9f078c45b8dcad1c28951a71445d543704591c161f4722856c3673d6fa2955ca088dd090a9cdc5c6f57fac69f30407bd7e
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c