Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/09/2024, 01:12

General

  • Target

    56453e3c7fe50caac1128195b65d335e3c387c6ba251143f5c3419e6512d3b66.exe

  • Size

    283KB

  • MD5

    0d02e72a7fe2f6b2a120782b8a64c0a2

  • SHA1

    0957f0570c7e2f9d38e78664282762fc43964e0d

  • SHA256

    56453e3c7fe50caac1128195b65d335e3c387c6ba251143f5c3419e6512d3b66

  • SHA512

    64bdcf43898f611bae1ad21aef5c26eb1c1434362544e4a734bbfa8b86f24032a5782498ea3dae9e1e144378a27ef47940ae6ea79e5918297e344181a93c5439

  • SSDEEP

    6144:PevsJRmJAvNCf3GIaWAlgO6dEkcsLOTvisCKsBPEO:PgGRmJUSGYAt6dEkcVTvlsBPEO

Malware Config

Extracted

Family

vidar

C2

https://t.me/edm0d

https://steamcommunity.com/profiles/76561199768374681

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0

Signatures

  • Detect Vidar Stealer 17 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56453e3c7fe50caac1128195b65d335e3c387c6ba251143f5c3419e6512d3b66.exe
    "C:\Users\Admin\AppData\Local\Temp\56453e3c7fe50caac1128195b65d335e3c387c6ba251143f5c3419e6512d3b66.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4504
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:552
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Checks computer location settings
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5076
        • C:\ProgramData\DBAEHCGHII.exe
          "C:\ProgramData\DBAEHCGHII.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4192
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 884
            4⤵
            • Program crash
            PID:1700
        • C:\ProgramData\IDAKJKEHDB.exe
          "C:\ProgramData\IDAKJKEHDB.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1760
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            PID:3512
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FHCGHJDBFIID" & exit
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1744
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 10
            4⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:5072
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4192 -ip 4192
      1⤵
        PID:4700

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\CBKJEGCBKKJE\BAAEHD

        Filesize

        160KB

        MD5

        f310cf1ff562ae14449e0167a3e1fe46

        SHA1

        85c58afa9049467031c6c2b17f5c12ca73bb2788

        SHA256

        e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

        SHA512

        1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

      • C:\ProgramData\DBAEHCGHII.exe

        Filesize

        322KB

        MD5

        a5098dee7d78acfb0294523855906aad

        SHA1

        5f44ca3f038456d07f7702cf061e7dad0039a8fb

        SHA256

        b07e6681aedf25d80c36bb0cb362d3d9c22c17a42d03e42e0d2413ad1be1a4c2

        SHA512

        b962efb2830b82e3cb4e39e3bd09ae68211dc0842ebd3c497e9425fcdd8ffb6eb09ca29386bf80fe9487346979592cbbc0f14c71e81129faf5ffd6f544226552

      • C:\ProgramData\IDAKJKEHDB.exe

        Filesize

        283KB

        MD5

        ac7314c596e766b8f4f368579e2e0f8f

        SHA1

        0e4941e5e4299d04b9408194542c7362bcabcd2f

        SHA256

        be442a04bc031b4dc72835efeeeb025e9a103c8012382173965fba30bd3a96b9

        SHA512

        4258b6d15cd1c87d1787507f9132e5cf2caebfbf46dd055950dec8bb55faa094571d5b88cc58078adbab49f72fd3439f14ccae04de3d4bde672a540699a49428

      • C:\ProgramData\mozglue.dll

        Filesize

        593KB

        MD5

        c8fd9be83bc728cc04beffafc2907fe9

        SHA1

        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

        SHA256

        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

        SHA512

        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

      • C:\ProgramData\nss3.dll

        Filesize

        2.0MB

        MD5

        1cc453cdf74f31e4d913ff9c10acdde2

        SHA1

        6e85eae544d6e965f15fa5c39700fa7202f3aafe

        SHA256

        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

        SHA512

        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE

        Filesize

        2KB

        MD5

        f3996f922326413e2e955f3774434d01

        SHA1

        a68789fa985ebfab0c61bbee12098e404288cded

        SHA256

        34a9640d4292dbc5d1fee85322b3c457eb2ee28284618a602ec936de9a104200

        SHA512

        34b7c1c1e5bdaa7da31887fce2b8069203922599824fd28e1db53cd0ebd343118c7899f56159eeb0500c96ca0ba4e9f28a6695f8032ca4acb4ee17204b746376

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

        Filesize

        2KB

        MD5

        e2e9309062d386d7fec2730d865be1b3

        SHA1

        30dbe40a07dd56429b70601ff35c954d78ee99b9

        SHA256

        01459ba654c52454a8dae37f078fffc280d3a13b55837fd82d05a9c902e88ebb

        SHA512

        46ec1842ed5b93bf5e2533ce2561b0035ff0beb8e5ce61ecb2ec7bdb13f54e38a7a44d258b6713deb5278b39a6cd8b8dff349d3a2a088f9f4014eed6262f6b63

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

        Filesize

        1KB

        MD5

        17bc873e2a1ececdb96ba865079e2f7a

        SHA1

        a44455ae9199b8f0b798ffe8952d2ce2b3cdf335

        SHA256

        aaf3cca466c1452b3c1947aebea6107b1fba212c1cf9a0bcb2f7515b2a6cccea

        SHA512

        cc0b2d9cd308ec3b289e67f8041a633099a69705587fd042201a3d2badc3cebdf18a971997fb9c3148ee9a016385f4657f74029bc47770e61c1b2c0c63f4adac

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE

        Filesize

        458B

        MD5

        afb998d6b14268fd9dc16ffb8e3442a5

        SHA1

        aab55076b2aa7ee304cbc47bc460eb1dfd6e6459

        SHA256

        1d0a884072a671e6c5a60203f78f64623c8eab8fbcc037f17604bdb593022575

        SHA512

        77214bf24fd430003e391f7d8f035d4eaa78c31bef886a71ded8066807a487d7b2f368f7b6508d96968df9f1c0642ce18a05b2c00cee138f5f9121fedc67857c

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

        Filesize

        450B

        MD5

        cac130cfb1beb98b565e90ce97b6e67a

        SHA1

        11e8c2de4086b6b9236b3f66a5e568c102a7a49d

        SHA256

        134506ae5bcb3223ad304558991a114edca36b6e9e58096aab90fe0a14b40578

        SHA512

        1307acab4a00695cbd9a6466bbd276d65de8f0a8771bcf547f2e88edde949a49788ce114f12d3663976af35c5c673a4bc6943a58da40154c59eec68da1e677bd

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

        Filesize

        458B

        MD5

        c740bab464e283971716571bc0c99068

        SHA1

        f1ed4329551a885c9e547d8e4a3a34ea0d97dd30

        SHA256

        36f4a3bbafeb0dcb8dec6fa139bac96f8fe023746f9329b50c116e3df0d08b4c

        SHA512

        732f95700e93d87bbb86d9d5fb5a4ac3f94dfc7685af1e8e4ac2c388498031b3e23980e136c9c6999837d2c0f09bc1d141008f9b714908ee176b13f243e8753c

      • memory/1760-121-0x0000000000C30000-0x0000000000C7A000-memory.dmp

        Filesize

        296KB

      • memory/3512-136-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/3512-137-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/3512-138-0x0000000020490000-0x00000000206EF000-memory.dmp

        Filesize

        2.4MB

      • memory/3512-152-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/3512-153-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/4192-106-0x000000007275E000-0x000000007275F000-memory.dmp

        Filesize

        4KB

      • memory/4192-107-0x0000000000310000-0x0000000000364000-memory.dmp

        Filesize

        336KB

      • memory/4504-0-0x00000000751EE000-0x00000000751EF000-memory.dmp

        Filesize

        4KB

      • memory/4504-12-0x00000000751E0000-0x0000000075990000-memory.dmp

        Filesize

        7.7MB

      • memory/4504-2-0x0000000005E40000-0x00000000063E4000-memory.dmp

        Filesize

        5.6MB

      • memory/4504-1-0x0000000000F70000-0x0000000000FBA000-memory.dmp

        Filesize

        296KB

      • memory/5076-26-0x0000000022790000-0x00000000229EF000-memory.dmp

        Filesize

        2.4MB

      • memory/5076-92-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5076-91-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5076-84-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5076-83-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5076-59-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5076-58-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5076-42-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5076-41-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5076-25-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5076-24-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5076-7-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5076-9-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5076-4-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB