Overview
overview
10Static
static
1Setup.exe
windows7-x64
10Setup.exe
windows10-1703-x64
10Setup.exe
windows10-2004-x64
10Setup.exe
windows11-21h2-x64
10Setup.exe
android-9-x86
Setup.exe
android-10-x64
Setup.exe
android-11-x64
Setup.exe
macos-10.15-amd64
1Setup.exe
ubuntu-18.04-amd64
Setup.exe
debian-9-armhf
Setup.exe
debian-9-mips
Setup.exe
debian-9-mipsel
Analysis
-
max time kernel
144s -
max time network
156s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
29-06-2024 02:51
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
Setup.exe
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral6
Sample
Setup.exe
Resource
android-x64-20240624-en
Behavioral task
behavioral7
Sample
Setup.exe
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral8
Sample
Setup.exe
Resource
macos-20240611-en
Behavioral task
behavioral9
Sample
Setup.exe
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral10
Sample
Setup.exe
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral11
Sample
Setup.exe
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral12
Sample
Setup.exe
Resource
debian9-mipsel-20240611-en
General
-
Target
Setup.exe
-
Size
707.9MB
-
MD5
b25431a1b7b821eef6f77698c18fabb7
-
SHA1
8986dac902bc4827925550dab54d522c9d508d50
-
SHA256
b81deb9f7a113389c170b54921cd8ec33216e7819b91b3a413e2ee79ad592434
-
SHA512
474e6f1ad5eb02557f3046e6f23f176bca72248617a2b6c4b9378ac18b72e32175a8976e3e8d106c454d12b946e920aa1048e374b701c218f87df1d335d15f27
-
SSDEEP
196608:P/tv60Dx802nynypt/G0o55XGyPkqPVGEt3eaie54JngocFYKAAPIVelZ3wTVCZU:tBx802nygh6WwZjeaF549X
Malware Config
Extracted
stealc
Extracted
vidar
10.1
bd7a7ef85507e39998176b88b253bdb9
https://t.me/memve4erin
https://steamcommunity.com/profiles/76561199699680841
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0
Signatures
-
Detect Vidar Stealer 5 IoCs
Processes:
resource yara_rule behavioral4/memory/2260-21-0x0000000001600000-0x0000000001D4B000-memory.dmp family_vidar_v7 behavioral4/memory/2260-24-0x0000000001600000-0x0000000001D4B000-memory.dmp family_vidar_v7 behavioral4/memory/2260-25-0x0000000001600000-0x0000000001D4B000-memory.dmp family_vidar_v7 behavioral4/memory/2260-26-0x0000000001600000-0x0000000001D4B000-memory.dmp family_vidar_v7 behavioral4/memory/2260-39-0x0000000001600000-0x0000000001D4B000-memory.dmp family_vidar_v7 -
Loads dropped DLL 1 IoCs
Processes:
coml.au3pid process 2260 coml.au3 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid process target process PID 1692 set thread context of 1364 1692 Setup.exe netsh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
coml.au3description ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString coml.au3 -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1680 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Setup.exenetsh.execoml.au3pid process 1692 Setup.exe 1692 Setup.exe 1364 netsh.exe 1364 netsh.exe 2260 coml.au3 2260 coml.au3 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Setup.exenetsh.exepid process 1692 Setup.exe 1364 netsh.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Setup.exenetsh.execoml.au3cmd.exedescription pid process target process PID 1692 wrote to memory of 1364 1692 Setup.exe netsh.exe PID 1692 wrote to memory of 1364 1692 Setup.exe netsh.exe PID 1692 wrote to memory of 1364 1692 Setup.exe netsh.exe PID 1692 wrote to memory of 1364 1692 Setup.exe netsh.exe PID 1364 wrote to memory of 2260 1364 netsh.exe coml.au3 PID 1364 wrote to memory of 2260 1364 netsh.exe coml.au3 PID 1364 wrote to memory of 2260 1364 netsh.exe coml.au3 PID 1364 wrote to memory of 2260 1364 netsh.exe coml.au3 PID 1364 wrote to memory of 2260 1364 netsh.exe coml.au3 PID 2260 wrote to memory of 1320 2260 coml.au3 cmd.exe PID 2260 wrote to memory of 1320 2260 coml.au3 cmd.exe PID 2260 wrote to memory of 1320 2260 coml.au3 cmd.exe PID 1320 wrote to memory of 1680 1320 cmd.exe timeout.exe PID 1320 wrote to memory of 1680 1320 cmd.exe timeout.exe PID 1320 wrote to memory of 1680 1320 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Event Triggered Execution: Netsh Helper DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\coml.au3C:\Users\Admin\AppData\Local\Temp\coml.au33⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\coml.au3" & rd /s /q "C:\ProgramData\KFCGDBAKKKFB" & exit4⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\timeout.exetimeout /t 105⤵
- Delays execution with timeout.exe
PID:1680
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.8MB
MD5957edcb00ce0b522499f6c799ea11053
SHA1b1c91d93701d206820e45118e0df50d34790d27d
SHA256e4456eea3e2fca53bc2a06fd247eba74bf668c39069d5c821d082ef7dfa03f5d
SHA512167cb1c01f28bc40f85d0d8f895346d147a286811550142ebdf659cc4ba92f015d4def386d58adf4c48b1946ee31ddd8dcbef50ba09533889e9ad161c9867eb6
-
Filesize
6.8MB
MD59722acf580727032fc0ee7e15405cb81
SHA1e1c22a06014956a1c4318e30e1e2f06204a2df0c
SHA256d21a368256d953ef7bb8e2365bc0609af23b511ef4f135e83a79c7515a1fc3b0
SHA512ef850b27d74da5598bffc4c989ee9ff14b4df680c960acb9505eaba81aee124c5be067b67626ba92b96b0ddba202d7498d7305e62e409d33e66a326b91f3728e
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c