Analysis
-
max time kernel
101s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23-08-2024 17:38
Static task
static1
Behavioral task
behavioral1
Sample
65db2eb88c0efcfc9f58d8d7b47320a0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
65db2eb88c0efcfc9f58d8d7b47320a0N.exe
Resource
win10v2004-20240802-en
General
-
Target
65db2eb88c0efcfc9f58d8d7b47320a0N.exe
-
Size
217KB
-
MD5
65db2eb88c0efcfc9f58d8d7b47320a0
-
SHA1
f55df2d7ad79f6ac232cb1734c37ff97184f22fb
-
SHA256
65356ac76d8f957aae149b790e52305ea0b285fe157a1e438c4500abc9bb810a
-
SHA512
b1117b8145b9496c5e98b0ed5ab368bd8109f199ddbf5aceca0bcab2c27a8a5212f1c04bb0e066bf20d56ed1f16e50273b1e18ebcf2b6aa9fb124620e9bb6e32
-
SSDEEP
3072:FUcJWOKIpK3eTm+o21xroGhtypsch2wJYPPEV5g9Mo5yurTisSWWqwdASPF1CoIu:wqpcejo21doGssckZKsZQKTdyu0TCqEO
Malware Config
Extracted
stealc
default
http://46.8.231.109
-
url_path
/c4754d4f680ead72.php
Extracted
vidar
10.8
3cd4672c6baedc17edab0cb86e9453d1
https://t.me/jamelwt
https://steamcommunity.com/profiles/76561199761128941
https://t.me/iyigunl
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Extracted
lumma
https://potentioallykeos.shop/api
Signatures
-
Detect Vidar Stealer 7 IoCs
Processes:
resource yara_rule behavioral2/memory/1504-105-0x0000000000400000-0x0000000000641000-memory.dmp family_vidar_v7 behavioral2/memory/1504-108-0x0000000000400000-0x0000000000641000-memory.dmp family_vidar_v7 behavioral2/memory/1504-110-0x0000000000400000-0x0000000000641000-memory.dmp family_vidar_v7 behavioral2/memory/1504-123-0x0000000000400000-0x0000000000641000-memory.dmp family_vidar_v7 behavioral2/memory/1504-124-0x0000000000400000-0x0000000000641000-memory.dmp family_vidar_v7 behavioral2/memory/1504-140-0x0000000000400000-0x0000000000641000-memory.dmp family_vidar_v7 behavioral2/memory/1504-141-0x0000000000400000-0x0000000000641000-memory.dmp family_vidar_v7 -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Executes dropped EXE 2 IoCs
Processes:
AdminBAAAAKJKJE.exeAdminFIDAFIEBFC.exepid process 1616 AdminBAAAAKJKJE.exe 3224 AdminFIDAFIEBFC.exe -
Loads dropped DLL 2 IoCs
Processes:
RegAsm.exepid process 4060 RegAsm.exe 4060 RegAsm.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
65db2eb88c0efcfc9f58d8d7b47320a0N.exeAdminBAAAAKJKJE.exeAdminFIDAFIEBFC.exedescription pid process target process PID 2752 set thread context of 4060 2752 65db2eb88c0efcfc9f58d8d7b47320a0N.exe RegAsm.exe PID 1616 set thread context of 2244 1616 AdminBAAAAKJKJE.exe RegAsm.exe PID 3224 set thread context of 1504 3224 AdminFIDAFIEBFC.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3332 2244 WerFault.exe RegAsm.exe 4540 2244 WerFault.exe RegAsm.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
RegAsm.exe65db2eb88c0efcfc9f58d8d7b47320a0N.exeRegAsm.execmd.exeAdminBAAAAKJKJE.exeRegAsm.execmd.exeAdminFIDAFIEBFC.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65db2eb88c0efcfc9f58d8d7b47320a0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdminBAAAAKJKJE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdminFIDAFIEBFC.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RegAsm.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
RegAsm.exeRegAsm.exepid process 4060 RegAsm.exe 4060 RegAsm.exe 4060 RegAsm.exe 4060 RegAsm.exe 1504 RegAsm.exe 1504 RegAsm.exe 1504 RegAsm.exe 1504 RegAsm.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
65db2eb88c0efcfc9f58d8d7b47320a0N.exeRegAsm.execmd.exeAdminBAAAAKJKJE.execmd.exeAdminFIDAFIEBFC.exedescription pid process target process PID 2752 wrote to memory of 4060 2752 65db2eb88c0efcfc9f58d8d7b47320a0N.exe RegAsm.exe PID 2752 wrote to memory of 4060 2752 65db2eb88c0efcfc9f58d8d7b47320a0N.exe RegAsm.exe PID 2752 wrote to memory of 4060 2752 65db2eb88c0efcfc9f58d8d7b47320a0N.exe RegAsm.exe PID 2752 wrote to memory of 4060 2752 65db2eb88c0efcfc9f58d8d7b47320a0N.exe RegAsm.exe PID 2752 wrote to memory of 4060 2752 65db2eb88c0efcfc9f58d8d7b47320a0N.exe RegAsm.exe PID 2752 wrote to memory of 4060 2752 65db2eb88c0efcfc9f58d8d7b47320a0N.exe RegAsm.exe PID 2752 wrote to memory of 4060 2752 65db2eb88c0efcfc9f58d8d7b47320a0N.exe RegAsm.exe PID 2752 wrote to memory of 4060 2752 65db2eb88c0efcfc9f58d8d7b47320a0N.exe RegAsm.exe PID 2752 wrote to memory of 4060 2752 65db2eb88c0efcfc9f58d8d7b47320a0N.exe RegAsm.exe PID 4060 wrote to memory of 1808 4060 RegAsm.exe cmd.exe PID 4060 wrote to memory of 1808 4060 RegAsm.exe cmd.exe PID 4060 wrote to memory of 1808 4060 RegAsm.exe cmd.exe PID 1808 wrote to memory of 1616 1808 cmd.exe AdminBAAAAKJKJE.exe PID 1808 wrote to memory of 1616 1808 cmd.exe AdminBAAAAKJKJE.exe PID 1808 wrote to memory of 1616 1808 cmd.exe AdminBAAAAKJKJE.exe PID 1616 wrote to memory of 2244 1616 AdminBAAAAKJKJE.exe RegAsm.exe PID 1616 wrote to memory of 2244 1616 AdminBAAAAKJKJE.exe RegAsm.exe PID 1616 wrote to memory of 2244 1616 AdminBAAAAKJKJE.exe RegAsm.exe PID 1616 wrote to memory of 2244 1616 AdminBAAAAKJKJE.exe RegAsm.exe PID 1616 wrote to memory of 2244 1616 AdminBAAAAKJKJE.exe RegAsm.exe PID 1616 wrote to memory of 2244 1616 AdminBAAAAKJKJE.exe RegAsm.exe PID 1616 wrote to memory of 2244 1616 AdminBAAAAKJKJE.exe RegAsm.exe PID 1616 wrote to memory of 2244 1616 AdminBAAAAKJKJE.exe RegAsm.exe PID 1616 wrote to memory of 2244 1616 AdminBAAAAKJKJE.exe RegAsm.exe PID 4060 wrote to memory of 4396 4060 RegAsm.exe cmd.exe PID 4060 wrote to memory of 4396 4060 RegAsm.exe cmd.exe PID 4060 wrote to memory of 4396 4060 RegAsm.exe cmd.exe PID 4396 wrote to memory of 3224 4396 cmd.exe AdminFIDAFIEBFC.exe PID 4396 wrote to memory of 3224 4396 cmd.exe AdminFIDAFIEBFC.exe PID 4396 wrote to memory of 3224 4396 cmd.exe AdminFIDAFIEBFC.exe PID 3224 wrote to memory of 1504 3224 AdminFIDAFIEBFC.exe RegAsm.exe PID 3224 wrote to memory of 1504 3224 AdminFIDAFIEBFC.exe RegAsm.exe PID 3224 wrote to memory of 1504 3224 AdminFIDAFIEBFC.exe RegAsm.exe PID 3224 wrote to memory of 1504 3224 AdminFIDAFIEBFC.exe RegAsm.exe PID 3224 wrote to memory of 1504 3224 AdminFIDAFIEBFC.exe RegAsm.exe PID 3224 wrote to memory of 1504 3224 AdminFIDAFIEBFC.exe RegAsm.exe PID 3224 wrote to memory of 1504 3224 AdminFIDAFIEBFC.exe RegAsm.exe PID 3224 wrote to memory of 1504 3224 AdminFIDAFIEBFC.exe RegAsm.exe PID 3224 wrote to memory of 1504 3224 AdminFIDAFIEBFC.exe RegAsm.exe PID 3224 wrote to memory of 1504 3224 AdminFIDAFIEBFC.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65db2eb88c0efcfc9f58d8d7b47320a0N.exe"C:\Users\Admin\AppData\Local\Temp\65db2eb88c0efcfc9f58d8d7b47320a0N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminBAAAAKJKJE.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\AdminBAAAAKJKJE.exe"C:\Users\AdminBAAAAKJKJE.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
PID:2244 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 12246⤵
- Program crash
PID:3332 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 12526⤵
- Program crash
PID:4540 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminFIDAFIEBFC.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\AdminFIDAFIEBFC.exe"C:\Users\AdminFIDAFIEBFC.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2244 -ip 22441⤵PID:548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2244 -ip 22441⤵PID:3624
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
277KB
MD58706191b083e3893406221c606f35f6f
SHA1ba2c5578e4720ce57ad1498bebf5f6c6c2e0f65c
SHA25604525f7fdcc5b5d6891f0a3ab3b6110b0cec2170d8695561cec9261964c334db
SHA5123bed02fa46ae4cd79844831ae0c88658cafae4dcf2aefc281c1593cf3010b963c3c4ec23539997682c2326ba3cf3260470a7b1aced4e0cc0976a18b8c866d08f
-
Filesize
191KB
MD5f03b96b5a46ecbeda6d4616d7a3a5a5f
SHA190da4ae7a9cb8220b5c6bf9da2e8514e97201198
SHA256b44da8b65f59bab4823e857a8d148ba663a99d6ba9d6e88f7db3cddfb1438ac2
SHA5125c64c1ab62111a7e130c20e78044151ea93cdafe0e189c3e638efe4d571515fa1976ef50a49669c0b37e21c5f7002c05cb7261e55876d08823e197658cd3a0b4