Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11-07-2024 12:18
Static task
static1
Behavioral task
behavioral1
Sample
softorganizer.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
softorganizer.exe
Resource
win10v2004-20240709-en
General
-
Target
softorganizer.exe
-
Size
5.4MB
-
MD5
d7a35e65bb9b48b344ee09594ac3193d
-
SHA1
face507db72044c594b930f0adc1cf6e841a2963
-
SHA256
e65f08b6749e63fea544cd201161e63abe6925e0e739faddda2bd4af5af56b97
-
SHA512
7122170e3b7edf14c96d04237e01015f3341182fbf5f8f7bf849d53fc04aee46b07ab7eae9a61e519ad52eff4f9af11e61ca0ade2f1dd784884e6e52f6f07090
-
SSDEEP
98304:nzDWWQWDUAe4qfKOmBKtFr8yVkLZeulQ:zFQWYAegO1TVtB
Malware Config
Extracted
vidar
https://steamcommunity.com/profiles/76561199735694209
https://t.me/puffclou
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1
Signatures
-
Detect Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2880-69-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral1/memory/2880-76-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral1/memory/2880-630-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
GDHIDHIEGI.exeKEBFHIJECF.exepid Process 2404 GDHIDHIEGI.exe 1656 KEBFHIJECF.exe -
Loads dropped DLL 14 IoCs
Processes:
MSBuild.exeWerFault.exeWerFault.exepid Process 2880 MSBuild.exe 2880 MSBuild.exe 2880 MSBuild.exe 2880 MSBuild.exe 2880 MSBuild.exe 960 WerFault.exe 960 WerFault.exe 960 WerFault.exe 2880 MSBuild.exe 2880 MSBuild.exe 2880 MSBuild.exe 1312 WerFault.exe 1312 WerFault.exe 1312 WerFault.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
softorganizer.exedescription pid Process procid_target PID 2016 set thread context of 2880 2016 softorganizer.exe 30 -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target Process procid_target 960 2404 WerFault.exe 33 1312 1656 WerFault.exe 35 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MSBuild.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MSBuild.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSBuild.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid Process 2824 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
MSBuild.exepid Process 2880 MSBuild.exe 2880 MSBuild.exe 2880 MSBuild.exe 2880 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
softorganizer.exedescription pid Process Token: SeDebugPrivilege 2016 softorganizer.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
softorganizer.exeMSBuild.exeGDHIDHIEGI.exeKEBFHIJECF.execmd.exedescription pid Process procid_target PID 2016 wrote to memory of 2880 2016 softorganizer.exe 30 PID 2016 wrote to memory of 2880 2016 softorganizer.exe 30 PID 2016 wrote to memory of 2880 2016 softorganizer.exe 30 PID 2016 wrote to memory of 2880 2016 softorganizer.exe 30 PID 2016 wrote to memory of 2880 2016 softorganizer.exe 30 PID 2016 wrote to memory of 2880 2016 softorganizer.exe 30 PID 2016 wrote to memory of 2880 2016 softorganizer.exe 30 PID 2016 wrote to memory of 2880 2016 softorganizer.exe 30 PID 2016 wrote to memory of 2880 2016 softorganizer.exe 30 PID 2016 wrote to memory of 2880 2016 softorganizer.exe 30 PID 2880 wrote to memory of 2404 2880 MSBuild.exe 33 PID 2880 wrote to memory of 2404 2880 MSBuild.exe 33 PID 2880 wrote to memory of 2404 2880 MSBuild.exe 33 PID 2880 wrote to memory of 2404 2880 MSBuild.exe 33 PID 2404 wrote to memory of 960 2404 GDHIDHIEGI.exe 34 PID 2404 wrote to memory of 960 2404 GDHIDHIEGI.exe 34 PID 2404 wrote to memory of 960 2404 GDHIDHIEGI.exe 34 PID 2404 wrote to memory of 960 2404 GDHIDHIEGI.exe 34 PID 2880 wrote to memory of 1656 2880 MSBuild.exe 35 PID 2880 wrote to memory of 1656 2880 MSBuild.exe 35 PID 2880 wrote to memory of 1656 2880 MSBuild.exe 35 PID 2880 wrote to memory of 1656 2880 MSBuild.exe 35 PID 1656 wrote to memory of 1312 1656 KEBFHIJECF.exe 36 PID 1656 wrote to memory of 1312 1656 KEBFHIJECF.exe 36 PID 1656 wrote to memory of 1312 1656 KEBFHIJECF.exe 36 PID 1656 wrote to memory of 1312 1656 KEBFHIJECF.exe 36 PID 2880 wrote to memory of 2608 2880 MSBuild.exe 37 PID 2880 wrote to memory of 2608 2880 MSBuild.exe 37 PID 2880 wrote to memory of 2608 2880 MSBuild.exe 37 PID 2880 wrote to memory of 2608 2880 MSBuild.exe 37 PID 2608 wrote to memory of 2824 2608 cmd.exe 39 PID 2608 wrote to memory of 2824 2608 cmd.exe 39 PID 2608 wrote to memory of 2824 2608 cmd.exe 39 PID 2608 wrote to memory of 2824 2608 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\softorganizer.exe"C:\Users\Admin\AppData\Local\Temp\softorganizer.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\ProgramData\GDHIDHIEGI.exe"C:\ProgramData\GDHIDHIEGI.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 1124⤵
- Loads dropped DLL
- Program crash
PID:960
-
-
-
C:\ProgramData\KEBFHIJECF.exe"C:\ProgramData\KEBFHIJECF.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1124⤵
- Loads dropped DLL
- Program crash
PID:1312
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DHDHCGHDHIDH" & exit3⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- Delays execution with timeout.exe
PID:2824
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
508KB
MD55dcb471423fbb62d7c218760aee4936d
SHA17d72a2295639a8702ecdb77cc020b7a9eef48b04
SHA256837340da10b33b25bca1c15db3b273bfde18110b46949e8c545f31756e7b44bd
SHA512d8febe1cc91bbacd1b0298eb88d0d25f7789ee962f4d4717cb74ca1d1081ecab78a4062923b31386bcae141900ee99c182836e52bbb4b9f362cd8bdf687dc736
-
Filesize
442KB
MD50b4cc01ce62da8ed72b98a896c11c1dd
SHA1eb87a11df4f7a0066389094ee9ba8a4e189794ad
SHA2566ab0929361ee1a7fdc900bb0f6e50e999183a7c1aef1f44951b7847e86dfd3bc
SHA512b24fb55140210cc3c8d5f2dec84f36314a93397351a7109701b05dcb47cfbaf437c74fcafb551d8a96e845ea656a5c618b4a229c6acba8c2d0ed3849ccc48b8d
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571