Analysis
-
max time kernel
94s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11-07-2024 12:18
Static task
static1
Behavioral task
behavioral1
Sample
softorganizer.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
softorganizer.exe
Resource
win10v2004-20240709-en
General
-
Target
softorganizer.exe
-
Size
5.4MB
-
MD5
d7a35e65bb9b48b344ee09594ac3193d
-
SHA1
face507db72044c594b930f0adc1cf6e841a2963
-
SHA256
e65f08b6749e63fea544cd201161e63abe6925e0e739faddda2bd4af5af56b97
-
SHA512
7122170e3b7edf14c96d04237e01015f3341182fbf5f8f7bf849d53fc04aee46b07ab7eae9a61e519ad52eff4f9af11e61ca0ade2f1dd784884e6e52f6f07090
-
SSDEEP
98304:nzDWWQWDUAe4qfKOmBKtFr8yVkLZeulQ:zFQWYAegO1TVtB
Malware Config
Extracted
vidar
https://steamcommunity.com/profiles/76561199735694209
https://t.me/puffclou
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1
Extracted
lumma
https://stationacutwo.shop/api
https://bouncedgowp.shop/api
https://bannngwko.shop/api
https://bargainnykwo.shop/api
https://affecthorsedpo.shop/api
https://radiationnopp.shop/api
https://answerrsdo.shop/api
https://publicitttyps.shop/api
https://benchillppwo.shop/api
https://reinforcedirectorywd.shop/api
Signatures
-
Detect Vidar Stealer 6 IoCs
Processes:
resource yara_rule behavioral2/memory/3536-69-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/3536-67-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/3536-73-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/3536-78-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/3536-170-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/3536-173-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
FBFIDBFHDB.exeHDAFBAEBKJ.exepid Process 3772 FBFIDBFHDB.exe 3308 HDAFBAEBKJ.exe -
Loads dropped DLL 2 IoCs
Processes:
MSBuild.exepid Process 3536 MSBuild.exe 3536 MSBuild.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
softorganizer.exeFBFIDBFHDB.exeHDAFBAEBKJ.exedescription pid Process procid_target PID 1332 set thread context of 3536 1332 softorganizer.exe 86 PID 3772 set thread context of 4592 3772 FBFIDBFHDB.exe 90 PID 3308 set thread context of 4724 3308 HDAFBAEBKJ.exe 93 -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MSBuild.exeRegAsm.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MSBuild.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSBuild.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid Process 4588 timeout.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
MSBuild.exeRegAsm.exepid Process 3536 MSBuild.exe 3536 MSBuild.exe 3536 MSBuild.exe 3536 MSBuild.exe 3536 MSBuild.exe 3536 MSBuild.exe 3536 MSBuild.exe 3536 MSBuild.exe 4724 RegAsm.exe 4724 RegAsm.exe 4724 RegAsm.exe 4724 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
softorganizer.exedescription pid Process Token: SeDebugPrivilege 1332 softorganizer.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
softorganizer.exeMSBuild.exeFBFIDBFHDB.exeHDAFBAEBKJ.execmd.exedescription pid Process procid_target PID 1332 wrote to memory of 3536 1332 softorganizer.exe 86 PID 1332 wrote to memory of 3536 1332 softorganizer.exe 86 PID 1332 wrote to memory of 3536 1332 softorganizer.exe 86 PID 1332 wrote to memory of 3536 1332 softorganizer.exe 86 PID 1332 wrote to memory of 3536 1332 softorganizer.exe 86 PID 1332 wrote to memory of 3536 1332 softorganizer.exe 86 PID 1332 wrote to memory of 3536 1332 softorganizer.exe 86 PID 1332 wrote to memory of 3536 1332 softorganizer.exe 86 PID 1332 wrote to memory of 3536 1332 softorganizer.exe 86 PID 3536 wrote to memory of 3772 3536 MSBuild.exe 88 PID 3536 wrote to memory of 3772 3536 MSBuild.exe 88 PID 3536 wrote to memory of 3772 3536 MSBuild.exe 88 PID 3772 wrote to memory of 4592 3772 FBFIDBFHDB.exe 90 PID 3772 wrote to memory of 4592 3772 FBFIDBFHDB.exe 90 PID 3772 wrote to memory of 4592 3772 FBFIDBFHDB.exe 90 PID 3772 wrote to memory of 4592 3772 FBFIDBFHDB.exe 90 PID 3772 wrote to memory of 4592 3772 FBFIDBFHDB.exe 90 PID 3772 wrote to memory of 4592 3772 FBFIDBFHDB.exe 90 PID 3772 wrote to memory of 4592 3772 FBFIDBFHDB.exe 90 PID 3772 wrote to memory of 4592 3772 FBFIDBFHDB.exe 90 PID 3772 wrote to memory of 4592 3772 FBFIDBFHDB.exe 90 PID 3536 wrote to memory of 3308 3536 MSBuild.exe 91 PID 3536 wrote to memory of 3308 3536 MSBuild.exe 91 PID 3536 wrote to memory of 3308 3536 MSBuild.exe 91 PID 3308 wrote to memory of 5100 3308 HDAFBAEBKJ.exe 92 PID 3308 wrote to memory of 5100 3308 HDAFBAEBKJ.exe 92 PID 3308 wrote to memory of 5100 3308 HDAFBAEBKJ.exe 92 PID 3308 wrote to memory of 4724 3308 HDAFBAEBKJ.exe 93 PID 3308 wrote to memory of 4724 3308 HDAFBAEBKJ.exe 93 PID 3308 wrote to memory of 4724 3308 HDAFBAEBKJ.exe 93 PID 3308 wrote to memory of 4724 3308 HDAFBAEBKJ.exe 93 PID 3308 wrote to memory of 4724 3308 HDAFBAEBKJ.exe 93 PID 3308 wrote to memory of 4724 3308 HDAFBAEBKJ.exe 93 PID 3308 wrote to memory of 4724 3308 HDAFBAEBKJ.exe 93 PID 3308 wrote to memory of 4724 3308 HDAFBAEBKJ.exe 93 PID 3308 wrote to memory of 4724 3308 HDAFBAEBKJ.exe 93 PID 3536 wrote to memory of 2212 3536 MSBuild.exe 94 PID 3536 wrote to memory of 2212 3536 MSBuild.exe 94 PID 3536 wrote to memory of 2212 3536 MSBuild.exe 94 PID 2212 wrote to memory of 4588 2212 cmd.exe 96 PID 2212 wrote to memory of 4588 2212 cmd.exe 96 PID 2212 wrote to memory of 4588 2212 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\softorganizer.exe"C:\Users\Admin\AppData\Local\Temp\softorganizer.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\ProgramData\FBFIDBFHDB.exe"C:\ProgramData\FBFIDBFHDB.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:4592
-
-
-
C:\ProgramData\HDAFBAEBKJ.exe"C:\ProgramData\HDAFBAEBKJ.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:5100
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4724
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KKKJEBAAECBG" & exit3⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- Delays execution with timeout.exe
PID:4588
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
508KB
MD55dcb471423fbb62d7c218760aee4936d
SHA17d72a2295639a8702ecdb77cc020b7a9eef48b04
SHA256837340da10b33b25bca1c15db3b273bfde18110b46949e8c545f31756e7b44bd
SHA512d8febe1cc91bbacd1b0298eb88d0d25f7789ee962f4d4717cb74ca1d1081ecab78a4062923b31386bcae141900ee99c182836e52bbb4b9f362cd8bdf687dc736
-
Filesize
442KB
MD50b4cc01ce62da8ed72b98a896c11c1dd
SHA1eb87a11df4f7a0066389094ee9ba8a4e189794ad
SHA2566ab0929361ee1a7fdc900bb0f6e50e999183a7c1aef1f44951b7847e86dfd3bc
SHA512b24fb55140210cc3c8d5f2dec84f36314a93397351a7109701b05dcb47cfbaf437c74fcafb551d8a96e845ea656a5c618b4a229c6acba8c2d0ed3849ccc48b8d
-
Filesize
160KB
MD5f310cf1ff562ae14449e0167a3e1fe46
SHA185c58afa9049467031c6c2b17f5c12ca73bb2788
SHA256e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
SHA5121196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
Filesize471B
MD5baa2409ed7f6a7e8bba952df083e96bc
SHA1d8ad93370da697703762fef037a411218e800a85
SHA256da9bbebc50ba4463f66d800e4f748bd5489d411b93e2b14b72e9095c33545d69
SHA5127404f98c6312fbe3c5ed747738de2655ca4bec1357f9566dabbb630ef110d39bfa03a5c5cf685d96c885ada550ef007358f9a5921d291dd0e2a486e41dd3d216
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
Filesize400B
MD5605e42c1174615ebb03fbd0f073383e0
SHA1a939ee83654c4d534fe8b54c8f1b2e2a18072043
SHA2565577426d83e3ee4d364d28f0aaaf9c361e21027dac215bff73bcc3c9f447fa4d
SHA5127c9fa2f72347c2d635b78176aaddcf436956de4fc2a1eca821dc6ba11da2e3f0f982e0055ca96cf8a0b60d4597719606c4cc7dfb553b4fa50bbb642208da8534
-
Filesize
34KB
MD56312eb72b629c5dd7d2dc44c339158ce
SHA11956fc476f484290133c39c9741ec0fdfbeb0544
SHA2562760332d6bbc2943cb00e5029081bc16fa549a2cf63fef65bafa72ef5173d5e8
SHA512f965061f7a208f13a40ec8003d24a917f6ef6c5421c023d28b984a7e43974b342409be7a4526fa414e9692a91a1c56b2013ca145b9ea997769328585f46ee4e1