Analysis

  • max time kernel
    94s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/09/2024, 06:34

General

  • Target

    16358e5cb11b110f739d10d61f23ae9107f01e3757f1c1bbc3f0e71b7404e579.exe

  • Size

    292KB

  • MD5

    b9e09917fbda00f390cf009dc958051d

  • SHA1

    23baeca0d2a64746112d308c644f8daf6136a4bf

  • SHA256

    16358e5cb11b110f739d10d61f23ae9107f01e3757f1c1bbc3f0e71b7404e579

  • SHA512

    53494a6e257030aa8a6373aacdf2490e0f1432d3c6556f9c57161b38ce4ec6dfe2d2c7dec732d029de6dc5d81b876f1be3c18892cc3f9305d00e2a21594fdd21

  • SSDEEP

    6144:aVlTsl/ziXVssyKy0HwGRNorqJy++eMumaCHjJp7MuwnwqW0HE/JJM5EO:Eul/OXV1yKpHLlMuWT7MuhqWceOEO

Malware Config

Extracted

Family

vidar

C2

https://t.me/edm0d

https://steamcommunity.com/profiles/76561199768374681

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0

Signatures

  • Detect Vidar Stealer 20 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\16358e5cb11b110f739d10d61f23ae9107f01e3757f1c1bbc3f0e71b7404e579.exe
    "C:\Users\Admin\AppData\Local\Temp\16358e5cb11b110f739d10d61f23ae9107f01e3757f1c1bbc3f0e71b7404e579.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:2476
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
          PID:928
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
            PID:724
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            2⤵
            • Checks computer location settings
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2080
            • C:\ProgramData\EHCAEGDHJK.exe
              "C:\ProgramData\EHCAEGDHJK.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2512
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                4⤵
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4412
                • C:\Program Files\Google\Chrome\Application\2UWXJI7STDF5RZP184GTN.exe
                  "C:\Program Files\Google\Chrome\Application\2UWXJI7STDF5RZP184GTN.exe"
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:5084
            • C:\ProgramData\GDBAKKKFBG.exe
              "C:\ProgramData\GDBAKKKFBG.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4516
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                PID:4460
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KKECFIEBGCAK" & exit
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2064
              • C:\Windows\SysWOW64\timeout.exe
                timeout /t 10
                4⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:1704

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Google\Chrome\Application\2UWXJI7STDF5RZP184GTN.exe

          Filesize

          63KB

          MD5

          0d5df43af2916f47d00c1573797c1a13

          SHA1

          230ab5559e806574d26b4c20847c368ed55483b0

          SHA256

          c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc

          SHA512

          f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

        • C:\ProgramData\EHCAEGDHJK.exe

          Filesize

          338KB

          MD5

          7abd5004d90827227cb77ecebc6c0aba

          SHA1

          39c7f736d4041cb246b31d34f455460cdc3a071e

          SHA256

          13d8eb0461863ad7a6f2cd6c20133e6141b7ee60c2cfa16be07b050a1702b5ad

          SHA512

          7d95b29386c7a42da65be1888ce33d1e6e323da9e667cd72def869da3dfd60209b023d03e5258fcf52a71d7d2dd9a98e620cd1a44bc0e68da6d9567041a5e616

        • C:\ProgramData\FIJJKECFCFBG\EHJDGH

          Filesize

          160KB

          MD5

          f310cf1ff562ae14449e0167a3e1fe46

          SHA1

          85c58afa9049467031c6c2b17f5c12ca73bb2788

          SHA256

          e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

          SHA512

          1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

        • C:\ProgramData\GDBAKKKFBG.exe

          Filesize

          292KB

          MD5

          9d0327bd2962fd98512fb4ad5fc9ad19

          SHA1

          37fd2898d15b6e4e4be596c11120649e374a091b

          SHA256

          86d1e9372127505a6200e134641390297bd255de3b742d874108cbf5670d3d9c

          SHA512

          9a768adcd08acc5766d2b7a46e1360c2a2551405248bf774bc736b196d902bbeee56e472bd8f94a8c993f54e6e2402a9a14d6131500cf7979b89ccdbdd6ecc15

        • C:\ProgramData\mozglue.dll

          Filesize

          593KB

          MD5

          c8fd9be83bc728cc04beffafc2907fe9

          SHA1

          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

          SHA256

          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

          SHA512

          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

        • C:\ProgramData\nss3.dll

          Filesize

          2.0MB

          MD5

          1cc453cdf74f31e4d913ff9c10acdde2

          SHA1

          6e85eae544d6e965f15fa5c39700fa7202f3aafe

          SHA256

          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

          SHA512

          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE

          Filesize

          2KB

          MD5

          6bfa4438231e0c1dec70cb1b1dc23963

          SHA1

          f75144276248f49cf6264ffe8af11ad6318eaa9b

          SHA256

          b34da0ff4c8f3d724a7384d6ea6e2afef4aef858643f5b751519b98d17c03175

          SHA512

          55e833538700a73c82d06d04d5c1ba7f38c38cb1581b7af7ae1dcb564b246eb8870e1a7ea529bac8a72dac3339303db475544a6471a64d4e9e221ec54286436f

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

          Filesize

          2KB

          MD5

          ed1b8c9857cb3300612b9339f6f4d22c

          SHA1

          4e53e144ca4e1851898b590df4853f3a0cb41761

          SHA256

          fba16f4ffd6fd89df324ba7a28c27fd7931d2e96c33548f1c0738f8f86f211a0

          SHA512

          69c55660c13829052f8e34a946c302d41c687e7300073a58c3d16033631537c5ce21653335e8925caf178bd636ac9c340ba74de23ba19c2dbeb9ae608e6033cc

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

          Filesize

          1KB

          MD5

          ff247b273beb82e454dfe89b75fab6c3

          SHA1

          bf42c1951a1f6bd8c5a2b8b5a78e293599595b36

          SHA256

          d7067700eb000ffaec1d567a39d77a72b01347c76ac369ed7fcea2d088fa324d

          SHA512

          32cb871655593f7020b33b0e3e1f5328fafc0e6e382db2b73d91432265809309a16992d6a94e55ab9034986c1281a2ab23389fe2348c2401c6a7f9a56d617d0c

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE

          Filesize

          458B

          MD5

          d81c06d7c35cfc68199d54b88d247e8a

          SHA1

          746d32179fe32e9cfaadca1612e923ee16719510

          SHA256

          ee68a278cd29fa04ce0a247d699afae7472ba30e7013fd35b116e6c732f35dad

          SHA512

          1017845b0029971f758f87fb83521489263d706c0427218bc4ae41a74368c6b5f446a066bea1f550f4566ed6f675a5d41c29600578f9870df26d5800b309fb0e

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

          Filesize

          450B

          MD5

          1bd0b56cd07cd66117820d0800c1e945

          SHA1

          554148dbbdd1dbddbaeceea20f9a2ea696474c64

          SHA256

          864f38e766a029aa350e1017ae380fc5ae5b039e5a867f90c9c2952d709c2e46

          SHA512

          2081224126c1c7160ff567110b07899f89298d59af0bba0fd3192d3b9fb0e6dfb238b0de3993c4624a52560c71e20cb7a5b2f1b2481a04fe364e6554e4fc0fe9

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

          Filesize

          458B

          MD5

          65d5afcf0a7f46589ad8a1993fcf01b9

          SHA1

          5823b20e34c21e67d583c65fb28530a2418c7fb4

          SHA256

          dc276e6d1469cdce71f12450456995b00031d7a5fbded6685dd845fa66456044

          SHA512

          026f94addeab76dbc00a31d50a3bb9b2f2da08007cfaf9cdccd24f114f28fb58bcf351ad62a4db8462afaf0a5a12fe025518b0eda7c12d88c6a0c64906e15ce1

        • memory/2080-43-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/2080-10-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/2080-60-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/2080-4-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/2080-42-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/2080-84-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/2080-91-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/2080-92-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/2080-93-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/2080-27-0x0000000022A40000-0x0000000022C9F000-memory.dmp

          Filesize

          2.4MB

        • memory/2080-59-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/2080-8-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/2080-25-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/2080-26-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/2512-117-0x0000000000160000-0x00000000001B6000-memory.dmp

          Filesize

          344KB

        • memory/2512-127-0x0000000073620000-0x0000000073DD0000-memory.dmp

          Filesize

          7.7MB

        • memory/2512-118-0x0000000073620000-0x0000000073DD0000-memory.dmp

          Filesize

          7.7MB

        • memory/2512-116-0x000000007362E000-0x000000007362F000-memory.dmp

          Filesize

          4KB

        • memory/4412-128-0x0000000000400000-0x0000000000459000-memory.dmp

          Filesize

          356KB

        • memory/4412-120-0x0000000000400000-0x0000000000459000-memory.dmp

          Filesize

          356KB

        • memory/4412-123-0x0000000000400000-0x0000000000459000-memory.dmp

          Filesize

          356KB

        • memory/4460-161-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/4460-162-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/4460-178-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/4460-148-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/4460-152-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/4460-150-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/4460-177-0x0000000000400000-0x0000000000657000-memory.dmp

          Filesize

          2.3MB

        • memory/4460-163-0x00000000223F0000-0x000000002264F000-memory.dmp

          Filesize

          2.4MB

        • memory/4516-146-0x0000000000210000-0x000000000025A000-memory.dmp

          Filesize

          296KB

        • memory/4772-2-0x0000000075300000-0x0000000075AB0000-memory.dmp

          Filesize

          7.7MB

        • memory/4772-6-0x0000000075300000-0x0000000075AB0000-memory.dmp

          Filesize

          7.7MB

        • memory/4772-0-0x000000007530E000-0x000000007530F000-memory.dmp

          Filesize

          4KB

        • memory/4772-1-0x0000000000BE0000-0x0000000000C2A000-memory.dmp

          Filesize

          296KB

        • memory/4772-11-0x0000000075300000-0x0000000075AB0000-memory.dmp

          Filesize

          7.7MB

        • memory/5084-131-0x0000000000EB0000-0x0000000000EC2000-memory.dmp

          Filesize

          72KB