Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 18:48
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
General
-
Target
file.exe
-
Size
403KB
-
MD5
8b0b12811b60a92a72b636a46fadb0ba
-
SHA1
0ab6b31b69b7964de2e9639169d036c68f9efd76
-
SHA256
1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c
-
SHA512
abf908cb7505acd792aa1d9a346ec1b635f5c078ad2104b5d5a0678cc54e216a843fbacba25ebff6a7baed6a6463ee8fc433ff1c71178775366b7f4aade1227a
-
SSDEEP
12288:dHROWCWIpXQ6dvhXe+iGaXImXN18/7LV+z+0EO:ludvbwX4/7LV/0t
Malware Config
Extracted
vidar
11
9bf5e431869643a2ac397d2dc0d687fb
https://steamcommunity.com/profiles/76561199780418869
https://t.me/ae5ed
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
Signatures
-
Detect Vidar Stealer 7 IoCs
resource yara_rule behavioral2/memory/4656-3-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral2/memory/4656-8-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral2/memory/4656-6-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral2/memory/4656-18-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral2/memory/4656-19-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral2/memory/4656-36-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral2/memory/4656-37-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2972 set thread context of 4656 2972 file.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4656 RegAsm.exe 4656 RegAsm.exe 4656 RegAsm.exe 4656 RegAsm.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2972 wrote to memory of 4052 2972 file.exe 83 PID 2972 wrote to memory of 4052 2972 file.exe 83 PID 2972 wrote to memory of 4052 2972 file.exe 83 PID 2972 wrote to memory of 4656 2972 file.exe 84 PID 2972 wrote to memory of 4656 2972 file.exe 84 PID 2972 wrote to memory of 4656 2972 file.exe 84 PID 2972 wrote to memory of 4656 2972 file.exe 84 PID 2972 wrote to memory of 4656 2972 file.exe 84 PID 2972 wrote to memory of 4656 2972 file.exe 84 PID 2972 wrote to memory of 4656 2972 file.exe 84 PID 2972 wrote to memory of 4656 2972 file.exe 84 PID 2972 wrote to memory of 4656 2972 file.exe 84 PID 2972 wrote to memory of 4656 2972 file.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4052
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4656
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1