Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    33s
  • max time network
    72s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/09/2024, 21:29

General

  • Target

    SecuriteInfo.com.Win32.MalwareX-gen.8690.29614.exe

  • Size

    283KB

  • MD5

    ad94d95684e998e00b4fb62806feec0f

  • SHA1

    e083a7fa2b3eaf930cb3eda5e4b6345bd516438f

  • SHA256

    7f69b755604b2ba054290d816326a1f8f6ae1a10c460f1a94da936d017ebaac7

  • SHA512

    7b4cd256a6205df6b007a5d47b07a34d80651df271742e2758fc225c0e3a6027674a7cb8bef7041680aba254a17eb531e0312b56ed4cd15084096bcf296903a2

  • SSDEEP

    6144:RQB/lK2qglRw5Mv2wGP3StkVwQHjSQdRCPCPO3216zEO:Rc8GPgecatkDKGIzEO

Malware Config

Extracted

Family

vidar

C2

https://t.me/fneogr

https://t.me/edm0d

https://steamcommunity.com/profiles/76561199768374681

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0

Signatures

  • Detect Vidar Stealer 26 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.8690.29614.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.8690.29614.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:2960
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2732
        • C:\ProgramData\IECFIEGDBK.exe
          "C:\ProgramData\IECFIEGDBK.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1036
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 560
            4⤵
            • Loads dropped DLL
            • Program crash
            PID:1260
        • C:\ProgramData\GDBAKKKFBG.exe
          "C:\ProgramData\GDBAKKKFBG.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1472
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1624
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BGDAAEHDHIIJ" & exit
          3⤵
            PID:1960
            • C:\Windows\SysWOW64\timeout.exe
              timeout /t 10
              4⤵
              • Delays execution with timeout.exe
              PID:2560
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 568
          2⤵
          • Program crash
          PID:2628

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\CBFIJEGIDBGI\AAEGHJ

        Filesize

        148KB

        MD5

        90a1d4b55edf36fa8b4cc6974ed7d4c4

        SHA1

        aba1b8d0e05421e7df5982899f626211c3c4b5c1

        SHA256

        7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

        SHA512

        ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        6aea1aca30232634663574c35052a033

        SHA1

        8d8deb5608b50c13178cd7ef6d3259ee0feaebb2

        SHA256

        40d380a1935c09c33e17e5479be752b835e2bbeffce096ccb6228da858bbb684

        SHA512

        e23b46393d7d73e0f8ae1330a919a8415665de70c07fb63e58fef813daa81385940bce57eff6e5ec293a6db7c49855f327cf7eaab5710b97082b93e6385fb14e

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        214d439513f2a8d0a086df466db824f8

        SHA1

        fb931e86561b696a7b2b16ec5701484b9f7c5da6

        SHA256

        9fcd5e1fbf3e2671a7a2febeca96986395bd5adac7ae374ac53a1549b458d2eb

        SHA512

        77fe557883c3d2a11aca4adc3cc619113f261ed34629cc5197f2d6a20d94301242242b615c740584623f9c36bcd2cf2a80a49f54aec2ad95e2cb189c5c40ecdb

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\56KJ964X\76561199768374681[1].htm

        Filesize

        33KB

        MD5

        55bbd9c2018ae48ee7114c87c19e68e7

        SHA1

        873fff74238dc54069d44dafb57b0e659a5c6920

        SHA256

        47a9cbb006677f946be9756bc608aa51f8bb39137a8998de2f3f47cb6e67cc97

        SHA512

        168aa60e1e41e727b95954686150f4bd72714a551deb983834c273961022aa14e54a844524b65bf416f6af96649104ffa9344915bc5caf67b89f362274c2e59b

      • C:\Users\Admin\AppData\Local\Temp\Cab7C24.tmp

        Filesize

        70KB

        MD5

        49aebf8cbd62d92ac215b2923fb1b9f5

        SHA1

        1723be06719828dda65ad804298d0431f6aff976

        SHA256

        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

        SHA512

        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

      • C:\Users\Admin\AppData\Local\Temp\Tar7C75.tmp

        Filesize

        181KB

        MD5

        4ea6026cf93ec6338144661bf1202cd1

        SHA1

        a1dec9044f750ad887935a01430bf49322fbdcb7

        SHA256

        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

        SHA512

        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

      • \ProgramData\GDBAKKKFBG.exe

        Filesize

        283KB

        MD5

        ac7314c596e766b8f4f368579e2e0f8f

        SHA1

        0e4941e5e4299d04b9408194542c7362bcabcd2f

        SHA256

        be442a04bc031b4dc72835efeeeb025e9a103c8012382173965fba30bd3a96b9

        SHA512

        4258b6d15cd1c87d1787507f9132e5cf2caebfbf46dd055950dec8bb55faa094571d5b88cc58078adbab49f72fd3439f14ccae04de3d4bde672a540699a49428

      • \ProgramData\IECFIEGDBK.exe

        Filesize

        322KB

        MD5

        a5098dee7d78acfb0294523855906aad

        SHA1

        5f44ca3f038456d07f7702cf061e7dad0039a8fb

        SHA256

        b07e6681aedf25d80c36bb0cb362d3d9c22c17a42d03e42e0d2413ad1be1a4c2

        SHA512

        b962efb2830b82e3cb4e39e3bd09ae68211dc0842ebd3c497e9425fcdd8ffb6eb09ca29386bf80fe9487346979592cbbc0f14c71e81129faf5ffd6f544226552

      • \ProgramData\mozglue.dll

        Filesize

        593KB

        MD5

        c8fd9be83bc728cc04beffafc2907fe9

        SHA1

        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

        SHA256

        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

        SHA512

        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

      • \ProgramData\nss3.dll

        Filesize

        2.0MB

        MD5

        1cc453cdf74f31e4d913ff9c10acdde2

        SHA1

        6e85eae544d6e965f15fa5c39700fa7202f3aafe

        SHA256

        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

        SHA512

        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

      • memory/1036-505-0x000000007415E000-0x000000007415F000-memory.dmp

        Filesize

        4KB

      • memory/1036-506-0x00000000003C0000-0x0000000000414000-memory.dmp

        Filesize

        336KB

      • memory/1472-547-0x0000000001340000-0x000000000138A000-memory.dmp

        Filesize

        296KB

      • memory/1624-567-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/1624-569-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/1624-572-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/1624-561-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/1624-773-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/1624-563-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/1624-754-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/1624-566-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/1624-740-0x0000000019FA0000-0x000000001A1FF000-memory.dmp

        Filesize

        2.4MB

      • memory/1624-721-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/1624-702-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/1624-575-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/1624-573-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2140-1-0x0000000000ED0000-0x0000000000F1A000-memory.dmp

        Filesize

        296KB

      • memory/2140-0-0x000000007415E000-0x000000007415F000-memory.dmp

        Filesize

        4KB

      • memory/2140-176-0x0000000074150000-0x000000007483E000-memory.dmp

        Filesize

        6.9MB

      • memory/2140-156-0x000000007415E000-0x000000007415F000-memory.dmp

        Filesize

        4KB

      • memory/2140-7-0x0000000074150000-0x000000007483E000-memory.dmp

        Filesize

        6.9MB

      • memory/2732-247-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2732-20-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2732-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2732-16-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2732-12-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2732-8-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2732-443-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2732-424-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2732-383-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2732-362-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2732-18-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2732-13-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2732-596-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2732-10-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2732-3-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2732-5-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2732-212-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2732-197-0x000000001DC90000-0x000000001DEEF000-memory.dmp

        Filesize

        2.4MB

      • memory/2732-196-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2732-177-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2732-157-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB