Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    28s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    18/09/2024, 01:14

General

  • Target

    44408030fc2d6ab0d35a060e03f750a4d53dd9045debd1c189da636d07e86147.exe

  • Size

    292KB

  • MD5

    26e1bcdecaa337ee8e8b3694603c803f

  • SHA1

    4d489fc1eb967acc177cdc5ff7cdd77dac3020d4

  • SHA256

    44408030fc2d6ab0d35a060e03f750a4d53dd9045debd1c189da636d07e86147

  • SHA512

    7c606989961c028555e27bb85658f7bc94d362f20b17702675eb24cb8a05ba0d52fa525e28ea74265d437ec3d09799481882fedbb987fc04edd5aafbfcdf623f

  • SSDEEP

    6144:O/U+c8P+Iwx+Sp66wGPJJNwK0LTyib+2VvW5EO:Os/9Jp6SBw7LTyiLW5EO

Malware Config

Extracted

Family

vidar

C2

https://t.me/edm0d

https://steamcommunity.com/profiles/76561199768374681

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0

Signatures

  • Detect Vidar Stealer 22 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\44408030fc2d6ab0d35a060e03f750a4d53dd9045debd1c189da636d07e86147.exe
    "C:\Users\Admin\AppData\Local\Temp\44408030fc2d6ab0d35a060e03f750a4d53dd9045debd1c189da636d07e86147.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:2816
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
          PID:2876
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
            PID:2924
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2932
            • C:\ProgramData\ECAKECAEGD.exe
              "C:\ProgramData\ECAKECAEGD.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2252
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1508
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 252
                  5⤵
                  • Program crash
                  PID:1936
            • C:\ProgramData\CGDBGCBGID.exe
              "C:\ProgramData\CGDBGCBGID.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2556
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                4⤵
                  PID:2696
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:2516
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\ECBAEBGHDAEC" & exit
                3⤵
                  PID:3040
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout /t 10
                    4⤵
                    • Delays execution with timeout.exe
                    PID:2528

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

              Filesize

              471B

              MD5

              a9a1372a0439df0204e4d41c403fa5f8

              SHA1

              c587388167e8347ba675ec5006699faeec23f488

              SHA256

              e26cfb5aee36722884618870d3516be88350fdc6683162d31ae8eb3c170febce

              SHA512

              52ae09aab02fbce6d88ad8a97f8ec73b99076ac32b8b7f6a3bbf35b6e631e2b7818dd3b7d88efa66987ad5475d01f414cb85963b8c3343a526d610f3c43a3c0c

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

              Filesize

              1KB

              MD5

              a266bb7dcc38a562631361bbf61dd11b

              SHA1

              3b1efd3a66ea28b16697394703a72ca340a05bd5

              SHA256

              df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

              SHA512

              0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              ab7f133503119c09a1a8c48b03c2f022

              SHA1

              b532b281cfc9960a36bf5479549fa88cdcf8158d

              SHA256

              a84f5010d8c79eb783c621a1e7baafde8d17f087e39efbda105ae04aa6477dac

              SHA512

              fd41720bdac3f1cac4d15f4ee9f93bc7cfb8c5ce2d81de017ac8654d3ee4769f556d6993605106b1dd2900462f4441822fdae34e8c6a5580fad26be0f3a8b9e6

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              7810c105b6252e2ce2728cdf7ce63eab

              SHA1

              ae4c132dab8ff64062dc0ee0baf28142b1f56596

              SHA256

              ff843eee2b5d851a9ffce405b160897b74a47355145239975f47ddbb5718f830

              SHA512

              1b45fd3761600b53b68f3fe87977b6a898849889921d3d304a1c7c23147f513629565c391b9fd68d3d134b0ee5dfaae44dc1937c5c7c70dd43da25a1a80438fd

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

              Filesize

              400B

              MD5

              cadcde394509343e451afa72d0025daf

              SHA1

              7135027925e23a69543a531a69bff1dd415a33dd

              SHA256

              54b6ccff2cd052306ec50cbe2794de8f36d308e4a5e9c7444110ac9652507619

              SHA512

              e4ab27977bd267c90168ee4e00a836df0ceff091db799e5adcdd1456a1ac1d6e212e05a02edcf925df7eda6ed402e17f1547a9bc8b0435d45ec836f1f78b6e6c

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

              Filesize

              242B

              MD5

              bc685177e79f362ec8b6f4697562e72b

              SHA1

              55c809f9c6c3eeedc5f1e56c0314b618bebbe96b

              SHA256

              791be148e5e27bffa351f679a82cb08309103e98ae7d8a4575c5596284526e49

              SHA512

              fd91e95891f7ba084f2dbe07af6074dc80d09a86edfdbba37ebb24403f0bc8b4866dd393cb93304310bd62f7ebfbae775903db206c7513de44526b7e8233c540

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84EXSCRK\76561199768374681[1].htm

              Filesize

              33KB

              MD5

              552b9d2124baec79ebccb697431fa636

              SHA1

              9ae1bf9ba96a529a4b4fe38eaaf89762b762f676

              SHA256

              6304c5489bdb1524ca55ac6ec4c915624a028dab16499942b0faceb125854b0b

              SHA512

              884e3371fb1e36459acb796629450e2d9f514b992e7bdae52f44d5d225498e27b5c10020ee99a8af18f9bd82262c97cc2e642ef606aa1c7a3b2449fb57b8e510

            • C:\Users\Admin\AppData\Local\Temp\Cab8E8B.tmp

              Filesize

              70KB

              MD5

              49aebf8cbd62d92ac215b2923fb1b9f5

              SHA1

              1723be06719828dda65ad804298d0431f6aff976

              SHA256

              b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

              SHA512

              bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

            • C:\Users\Admin\AppData\Local\Temp\Tar8EAE.tmp

              Filesize

              181KB

              MD5

              4ea6026cf93ec6338144661bf1202cd1

              SHA1

              a1dec9044f750ad887935a01430bf49322fbdcb7

              SHA256

              8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

              SHA512

              6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

            • \ProgramData\CGDBGCBGID.exe

              Filesize

              292KB

              MD5

              9d0327bd2962fd98512fb4ad5fc9ad19

              SHA1

              37fd2898d15b6e4e4be596c11120649e374a091b

              SHA256

              86d1e9372127505a6200e134641390297bd255de3b742d874108cbf5670d3d9c

              SHA512

              9a768adcd08acc5766d2b7a46e1360c2a2551405248bf774bc736b196d902bbeee56e472bd8f94a8c993f54e6e2402a9a14d6131500cf7979b89ccdbdd6ecc15

            • \ProgramData\ECAKECAEGD.exe

              Filesize

              338KB

              MD5

              7abd5004d90827227cb77ecebc6c0aba

              SHA1

              39c7f736d4041cb246b31d34f455460cdc3a071e

              SHA256

              13d8eb0461863ad7a6f2cd6c20133e6141b7ee60c2cfa16be07b050a1702b5ad

              SHA512

              7d95b29386c7a42da65be1888ce33d1e6e323da9e667cd72def869da3dfd60209b023d03e5258fcf52a71d7d2dd9a98e620cd1a44bc0e68da6d9567041a5e616

            • \ProgramData\mozglue.dll

              Filesize

              593KB

              MD5

              c8fd9be83bc728cc04beffafc2907fe9

              SHA1

              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

              SHA256

              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

              SHA512

              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

            • \ProgramData\nss3.dll

              Filesize

              2.0MB

              MD5

              1cc453cdf74f31e4d913ff9c10acdde2

              SHA1

              6e85eae544d6e965f15fa5c39700fa7202f3aafe

              SHA256

              ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

              SHA512

              dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

            • memory/1508-568-0x0000000000400000-0x0000000000459000-memory.dmp

              Filesize

              356KB

            • memory/1508-569-0x0000000000400000-0x0000000000459000-memory.dmp

              Filesize

              356KB

            • memory/1508-570-0x0000000000400000-0x0000000000459000-memory.dmp

              Filesize

              356KB

            • memory/1508-572-0x0000000000400000-0x0000000000459000-memory.dmp

              Filesize

              356KB

            • memory/1508-574-0x0000000000400000-0x0000000000459000-memory.dmp

              Filesize

              356KB

            • memory/1508-577-0x0000000000400000-0x0000000000459000-memory.dmp

              Filesize

              356KB

            • memory/1508-579-0x0000000000400000-0x0000000000459000-memory.dmp

              Filesize

              356KB

            • memory/2252-555-0x00000000727FE000-0x00000000727FF000-memory.dmp

              Filesize

              4KB

            • memory/2252-557-0x00000000727F0000-0x0000000072EDE000-memory.dmp

              Filesize

              6.9MB

            • memory/2252-588-0x00000000727F0000-0x0000000072EDE000-memory.dmp

              Filesize

              6.9MB

            • memory/2252-581-0x00000000727F0000-0x0000000072EDE000-memory.dmp

              Filesize

              6.9MB

            • memory/2252-556-0x0000000000070000-0x00000000000C6000-memory.dmp

              Filesize

              344KB

            • memory/2280-1-0x0000000000FF0000-0x000000000103A000-memory.dmp

              Filesize

              296KB

            • memory/2280-2-0x0000000073EC0000-0x00000000745AE000-memory.dmp

              Filesize

              6.9MB

            • memory/2280-4-0x0000000073EC0000-0x00000000745AE000-memory.dmp

              Filesize

              6.9MB

            • memory/2280-16-0x0000000073EC0000-0x00000000745AE000-memory.dmp

              Filesize

              6.9MB

            • memory/2280-0-0x0000000073ECE000-0x0000000073ECF000-memory.dmp

              Filesize

              4KB

            • memory/2516-626-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2516-823-0x000000001E000000-0x000000001E25F000-memory.dmp

              Filesize

              2.4MB

            • memory/2516-800-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2516-777-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2516-628-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2516-633-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2516-634-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2516-636-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2516-630-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2516-624-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2516-622-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2556-600-0x0000000000190000-0x00000000001DA000-memory.dmp

              Filesize

              296KB

            • memory/2932-439-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2932-227-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2932-15-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2932-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/2932-10-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2932-159-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2932-9-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2932-8-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2932-7-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2932-420-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2932-377-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2932-13-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2932-6-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2932-358-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2932-197-0x00000000204B0000-0x000000002070F000-memory.dmp

              Filesize

              2.4MB

            • memory/2932-208-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2932-5-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2932-18-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB

            • memory/2932-178-0x0000000000400000-0x0000000000657000-memory.dmp

              Filesize

              2.3MB