Analysis

  • max time kernel
    94s
  • max time network
    204s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-07-2024 12:18

General

  • Target

    softorganizer.exe

  • Size

    5.4MB

  • MD5

    d7a35e65bb9b48b344ee09594ac3193d

  • SHA1

    face507db72044c594b930f0adc1cf6e841a2963

  • SHA256

    e65f08b6749e63fea544cd201161e63abe6925e0e739faddda2bd4af5af56b97

  • SHA512

    7122170e3b7edf14c96d04237e01015f3341182fbf5f8f7bf849d53fc04aee46b07ab7eae9a61e519ad52eff4f9af11e61ca0ade2f1dd784884e6e52f6f07090

  • SSDEEP

    98304:nzDWWQWDUAe4qfKOmBKtFr8yVkLZeulQ:zFQWYAegO1TVtB

Malware Config

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199735694209

https://t.me/puffclou

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1

Extracted

Family

lumma

C2

https://stationacutwo.shop/api

https://bouncedgowp.shop/api

https://bannngwko.shop/api

https://bargainnykwo.shop/api

https://affecthorsedpo.shop/api

https://radiationnopp.shop/api

https://answerrsdo.shop/api

https://publicitttyps.shop/api

https://benchillppwo.shop/api

https://reinforcedirectorywd.shop/api

Signatures

  • Detect Vidar Stealer 6 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Stealc

    Stealc is an infostealer written in C++.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\softorganizer.exe
    "C:\Users\Admin\AppData\Local\Temp\softorganizer.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1332
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3536
      • C:\ProgramData\FBFIDBFHDB.exe
        "C:\ProgramData\FBFIDBFHDB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3772
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:4592
        • C:\ProgramData\HDAFBAEBKJ.exe
          "C:\ProgramData\HDAFBAEBKJ.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:3308
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
              PID:5100
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:4724
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KKKJEBAAECBG" & exit
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2212
            • C:\Windows\SysWOW64\timeout.exe
              timeout /t 10
              4⤵
              • Delays execution with timeout.exe
              PID:4588

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\FBFIDBFHDB.exe

        Filesize

        508KB

        MD5

        5dcb471423fbb62d7c218760aee4936d

        SHA1

        7d72a2295639a8702ecdb77cc020b7a9eef48b04

        SHA256

        837340da10b33b25bca1c15db3b273bfde18110b46949e8c545f31756e7b44bd

        SHA512

        d8febe1cc91bbacd1b0298eb88d0d25f7789ee962f4d4717cb74ca1d1081ecab78a4062923b31386bcae141900ee99c182836e52bbb4b9f362cd8bdf687dc736

      • C:\ProgramData\HDAFBAEBKJ.exe

        Filesize

        442KB

        MD5

        0b4cc01ce62da8ed72b98a896c11c1dd

        SHA1

        eb87a11df4f7a0066389094ee9ba8a4e189794ad

        SHA256

        6ab0929361ee1a7fdc900bb0f6e50e999183a7c1aef1f44951b7847e86dfd3bc

        SHA512

        b24fb55140210cc3c8d5f2dec84f36314a93397351a7109701b05dcb47cfbaf437c74fcafb551d8a96e845ea656a5c618b4a229c6acba8c2d0ed3849ccc48b8d

      • C:\ProgramData\IDBGHDGHCGHC\BAEBGH

        Filesize

        160KB

        MD5

        f310cf1ff562ae14449e0167a3e1fe46

        SHA1

        85c58afa9049467031c6c2b17f5c12ca73bb2788

        SHA256

        e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

        SHA512

        1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

      • C:\ProgramData\mozglue.dll

        Filesize

        593KB

        MD5

        c8fd9be83bc728cc04beffafc2907fe9

        SHA1

        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

        SHA256

        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

        SHA512

        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

      • C:\ProgramData\nss3.dll

        Filesize

        2.0MB

        MD5

        1cc453cdf74f31e4d913ff9c10acdde2

        SHA1

        6e85eae544d6e965f15fa5c39700fa7202f3aafe

        SHA256

        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

        SHA512

        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

        Filesize

        471B

        MD5

        baa2409ed7f6a7e8bba952df083e96bc

        SHA1

        d8ad93370da697703762fef037a411218e800a85

        SHA256

        da9bbebc50ba4463f66d800e4f748bd5489d411b93e2b14b72e9095c33545d69

        SHA512

        7404f98c6312fbe3c5ed747738de2655ca4bec1357f9566dabbb630ef110d39bfa03a5c5cf685d96c885ada550ef007358f9a5921d291dd0e2a486e41dd3d216

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

        Filesize

        400B

        MD5

        605e42c1174615ebb03fbd0f073383e0

        SHA1

        a939ee83654c4d534fe8b54c8f1b2e2a18072043

        SHA256

        5577426d83e3ee4d364d28f0aaaf9c361e21027dac215bff73bcc3c9f447fa4d

        SHA512

        7c9fa2f72347c2d635b78176aaddcf436956de4fc2a1eca821dc6ba11da2e3f0f982e0055ca96cf8a0b60d4597719606c4cc7dfb553b4fa50bbb642208da8534

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5G8JI3LV\76561199735694209[1].htm

        Filesize

        34KB

        MD5

        6312eb72b629c5dd7d2dc44c339158ce

        SHA1

        1956fc476f484290133c39c9741ec0fdfbeb0544

        SHA256

        2760332d6bbc2943cb00e5029081bc16fa549a2cf63fef65bafa72ef5173d5e8

        SHA512

        f965061f7a208f13a40ec8003d24a917f6ef6c5421c023d28b984a7e43974b342409be7a4526fa414e9692a91a1c56b2013ca145b9ea997769328585f46ee4e1

      • memory/1332-36-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-31-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-12-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-16-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-66-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-64-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-71-0x0000000074970000-0x0000000075120000-memory.dmp

        Filesize

        7.7MB

      • memory/1332-63-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-60-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-58-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-56-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-54-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-52-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-51-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-48-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-46-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-44-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-42-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-40-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-38-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-5-0x0000000005A50000-0x0000000005BA4000-memory.dmp

        Filesize

        1.3MB

      • memory/1332-34-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-32-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-6-0x0000000005580000-0x000000000559C000-memory.dmp

        Filesize

        112KB

      • memory/1332-29-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-26-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-24-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-22-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-20-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-19-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-14-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-10-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-8-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-7-0x0000000005580000-0x0000000005595000-memory.dmp

        Filesize

        84KB

      • memory/1332-72-0x0000000074970000-0x0000000075120000-memory.dmp

        Filesize

        7.7MB

      • memory/1332-0-0x000000007497E000-0x000000007497F000-memory.dmp

        Filesize

        4KB

      • memory/1332-1-0x0000000000680000-0x0000000000BE4000-memory.dmp

        Filesize

        5.4MB

      • memory/1332-2-0x0000000005690000-0x000000000572C000-memory.dmp

        Filesize

        624KB

      • memory/1332-3-0x0000000074970000-0x0000000075120000-memory.dmp

        Filesize

        7.7MB

      • memory/1332-4-0x0000000005840000-0x0000000005A4A000-memory.dmp

        Filesize

        2.0MB

      • memory/1332-155-0x0000000074970000-0x0000000075120000-memory.dmp

        Filesize

        7.7MB

      • memory/3536-170-0x0000000000400000-0x0000000000648000-memory.dmp

        Filesize

        2.3MB

      • memory/3536-173-0x0000000000400000-0x0000000000648000-memory.dmp

        Filesize

        2.3MB

      • memory/3536-78-0x0000000000400000-0x0000000000648000-memory.dmp

        Filesize

        2.3MB

      • memory/3536-73-0x0000000000400000-0x0000000000648000-memory.dmp

        Filesize

        2.3MB

      • memory/3536-67-0x0000000000400000-0x0000000000648000-memory.dmp

        Filesize

        2.3MB

      • memory/3536-69-0x0000000000400000-0x0000000000648000-memory.dmp

        Filesize

        2.3MB

      • memory/4592-156-0x0000000000400000-0x000000000044F000-memory.dmp

        Filesize

        316KB