Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07-09-2024 04:32
General
-
Target
0xds.exe
-
Size
11.4MB
-
MD5
bdb7e2090cd4cb5e75d7701b51769f40
-
SHA1
accaafb67f13135bdb27b43641f4151360d6c89c
-
SHA256
2ddc5ba89d79c752e61e07956f00419dbcee56f34589ca62628dc87d30343860
-
SHA512
06a33313ef1ede5a3082968f7ff29d31a90bb5c1570571b6fca4580b277ea7fad6c068403068d282c4e8fa9bad5811c5d4d3cef5075cf983143521cea3bcff3f
-
SSDEEP
196608:TvGacofn0NPExHJwtbq70rkOdc8nK1lK3XUU+7ZlMjn7og871zmvQIvQyMIoVGHc:Tveof0N8UJqGkgEFkog87MhvN0GHc
Malware Config
Extracted
vidar
https://t.me/edm0d
https://steamcommunity.com/profiles/76561199768374681
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
Signatures
-
Detect Vidar Stealer 3 IoCs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 11 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 13 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 1 IoCs
-
Modifies data under HKEY_USERS 3 IoCs
-
Modifies registry class 23 IoCs
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of WriteProcessMemory 43 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0xds.exe"C:\Users\Admin\AppData\Local\Temp\0xds.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\fcproinstall\fcproinstall 1.0.0\install\A6A4D74\fcproinstall.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\0xds.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1725442918 "2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AACCBCBADC3F01AA8315FAF0A8366720 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4BAE56CD75657B85FB3816D86D04B5042⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\WindowsActiveServices\Patch.exe"C:\Users\Admin\AppData\Roaming\WindowsActiveServices\Patch.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AZABvAHcAcwBBAGMAdABpAHYAZQBTAGUAcgB2AGkAYwBlAHMAXABQAGEAdABjAGgALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAFAAYQB0AGMAaAAuAGUAeABlADsA3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WindowsNetworkServices\WindowsNetwork.exe"C:\Users\Admin\AppData\Roaming\WindowsNetworkServices\WindowsNetwork.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BGDAKEHIIDGD" & exit5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 106⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
-
-
C:\Program Files (x86)\fcproinstall\fcproinstall\fcproinstall.exe"C:\Program Files (x86)\fcproinstall\fcproinstall\fcproinstall.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-G7P7F.tmp\fcproinstall.tmp"C:\Users\Admin\AppData\Local\Temp\is-G7P7F.tmp\fcproinstall.tmp" /SL5="$C0060,8669330,121344,C:\Program Files (x86)\fcproinstall\fcproinstall\fcproinstall.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD55f86339d4d4eaaf25fd1ac34a5fa6225
SHA151127820034266eed8323c63c50667e8927dd235
SHA256348b34bdfdeed2179462fa22c4eb9c25cc4017eb792cde39dee194d053c8ed41
SHA512d743bafb33536fc1958ff93514dfcdec6d24871d06a01d719bd51477ab52e82493763bb71615d8249313d12b08f2b8ec1db27fa93814f0763b4fd0070641a5b7
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
378KB
MD50981d5c068a9c33f4e8110f81ffbb92e
SHA1badb871adf6f24aba6923b9b21b211cea2aeca77
SHA256b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68
SHA51259cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb
-
Filesize
264KB
MD5c46cf092ca90dec5d9794d58bc3d60af
SHA1ee85693b181df0518ec1404831d0d0b05c97fdaf
SHA256e708ccdb34685d4df6d7a8959f2dc98d28f1a5bbf89120ff595613a1df7ab2d7
SHA512acbd3ab6958eb2b78cb0884ffba5bed24249421c1db1c2093e42f69a80bffdaaaedb785b726e742a1dfbc16499724ca3f56e6027dbbace840a5eb7f8f9d68af0
-
Filesize
439KB
MD55c71d85721484031e2caf286c1ed856d
SHA1f856bd5367298b716eb883e727ec45fef3db7ef0
SHA2565ea46f738d4a28b69243bf2b3bf57fd15a261d96348025d4ce17d860f19644c8
SHA512eb77901879169410f1bfe6981c23312f0cd07be4aa8deaa24c20f374a833b7d29d99432e6c7ee8b44c219ce0758a5cd6a26c6f266b85c5e78f3f995c4cf4a378
-
Filesize
8.6MB
MD51c2b96c284a4b3e7b7d2f9fa438fa26f
SHA12bc4b6936a8a22fba48fcde053932e5ea73e9837
SHA2566115d9356d8421d392f5eaa1516d7618e8c681036956ccc7132a76eca493c74c
SHA512ad36e73ae4a820b67d787d0c1800536e5b3e167974385fb10f8788c8b891963003d563ee4db8e6897deb2103a4d8d7946a2d2628fbb5aebf80987729d1eae7e8
-
Filesize
1.1MB
MD5b2f3126e0396807fa21245851545ca4b
SHA15d384f46b3021240094ecfc03fa41032fc86e7c7
SHA256e5ff1a0434f1de5a65108b1ab5e29c93bd9513c63ea33911c7fc04884ccd00d1
SHA5129e0d448dd5585e41c5c13711841de2bd5771b724be465ad6ae38d2a5b76e2f7c3e28fa6ae17a469fff22582f497b570d9394ff101a3c6b24bb3ae12de55c4c74
-
Filesize
202KB
MD52ca6d4ed5dd15fb7934c87e857f5ebfc
SHA1383a55cc0ab890f41b71ca67e070ac7c903adeb6
SHA25639412aacdcddc4b2b3cfeb126456edb125ce8cadb131ca5c23c031db4431c5fc
SHA512ce11aa5bd7b0da4baf07146e8377ff0331c1d4b04aaa4408373b4dd0fe2c3f82c84b179d9a90d26cdaa02180f22276d96cf491f9ede66f5f1da6f43cc72e5ac4
-
Filesize
567KB
MD55f1b243813a203c66ba735139d8ce0c7
SHA1c60a57668d348a61e4e2f12115afb9f9024162ba
SHA25652d5b228221cd5276e4ee2a038e0ce0cf494d5af9c23ac45dcbfadc3115c8cb2
SHA512083c6d1af44847db4b6fb90349234128141a838d1d438d5c24f5063539a8087f0814d06cfa162aeace20e162292f64c7635b4a0e81b2ca972706cfbc484adfb5
-
Filesize
23.7MB
MD5654a9589c7dd9c2809d36c8070245f76
SHA1ff2117434ea920638959709ea49dfc05bdabc0a1
SHA256662c182012a04e023d121316b3a2a620e7ecd25a535c9dfa651ff5dc9a536d6a
SHA5121f3c38a54b6354656f17d2f45ac0757ca3ab3097b71d5892b3d5ef868134c29932594c0b5aaf737895ee60bf083cde77c2107292e321965bbcf57fe17419bccf
-
Filesize
6KB
MD556222238fc522ed1269f4fed530ca4e0
SHA1051659db8aaee8c7d89d43f5ff9678c76aa44a7b
SHA25625b0364171dab01fa412a907821aa44d83859da3de29ad504f687aad337de72c
SHA51207ca8e1b6b81315e275cda4195326a34414595f5073c72b29cd8aa507f4c8a9c4fb8e0acd9bdb6d67b60d1b408d8c938c9e238309db4c8a6f649381574f861b5
-
Filesize
32KB
-
Filesize
624KB
-
Filesize
2.3MB
-
Filesize
2.4MB
-
Filesize
2.3MB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
304KB
-
Filesize
176KB
-
Filesize
184KB
-
Filesize
280KB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
464KB
-
Filesize
1.2MB
-
Filesize
3.3MB
-
Filesize
32KB
-
Filesize
652KB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
40KB
-
Filesize
600KB
-
Filesize
68KB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
104KB
-
Filesize
200KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
216KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
160KB
-
Filesize
160KB