vidar | cbe9ac361320c689ea74990eb5b752c63b9bfec9deeb09ce7cfaaafb6baf41ef

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbe9ac361320c689ea74990eb5b752c63b9bfec9deeb09ce7cfaaafb6baf41ef.exe
Size

1.1MB
MD5

9a30ee005b2b33436f0c5d6600507674
SHA1

dae6301ecc10242b609e8b1d1d624772de14c28f
SHA256

cbe9ac361320c689ea74990eb5b752c63b9bfec9deeb09ce7cfaaafb6baf41ef
SHA512

59b0ba792acdc46a61e07cddf7a3c3d051743433062432cfef0daba33ef9ff9b5be6f2e46324ee405132fc4d282cec62fc8b79471bc184392bd5d34e814b1162
SSDEEP

24576:/9ZWDjMzibzyO/xkZawNwKrXsjGiYqbDxLOJDjt5r7L2rvqHq:/6DjY495kTwmXseqbD9OJXtFqvqK

Score

10^/10

vidar dc012f980711fe846b1fec1f4b705f4a credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

dc012f980711fe846b1fec1f4b705f4a

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Signatures

Detect Vidar Stealer 11 IoCs

stealer

resource	yara_rule
behavioral1/memory/1148-40-0x0000000003C50000-0x0000000003EC6000-memory.dmp	family_vidar_v7
behavioral1/memory/1148-41-0x0000000003C50000-0x0000000003EC6000-memory.dmp	family_vidar_v7
behavioral1/memory/1148-42-0x0000000003C50000-0x0000000003EC6000-memory.dmp	family_vidar_v7
behavioral1/memory/1148-183-0x0000000003C50000-0x0000000003EC6000-memory.dmp	family_vidar_v7
behavioral1/memory/1148-202-0x0000000003C50000-0x0000000003EC6000-memory.dmp	family_vidar_v7
behavioral1/memory/1148-231-0x0000000003C50000-0x0000000003EC6000-memory.dmp	family_vidar_v7
behavioral1/memory/1148-250-0x0000000003C50000-0x0000000003EC6000-memory.dmp	family_vidar_v7
behavioral1/memory/1148-381-0x0000000003C50000-0x0000000003EC6000-memory.dmp	family_vidar_v7
behavioral1/memory/1148-400-0x0000000003C50000-0x0000000003EC6000-memory.dmp	family_vidar_v7
behavioral1/memory/1148-461-0x0000000003C50000-0x0000000003EC6000-memory.dmp	family_vidar_v7
behavioral1/memory/1148-480-0x0000000003C50000-0x0000000003EC6000-memory.dmp	family_vidar_v7

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 1148 created 1204	1148	Immigrants.pif	21
PID 1148 created 1204	1148	Immigrants.pif	21

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NetSwift.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NetSwift.url	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1148	Immigrants.pif

Loads dropped DLL 3 IoCs

pid	Process
988	cmd.exe
1148	Immigrants.pif
1148	Immigrants.pif

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2476	tasklist.exe
2944	tasklist.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ReachDistributors	cbe9ac361320c689ea74990eb5b752c63b9bfec9deeb09ce7cfaaafb6baf41ef.exe
File opened for modification	C:\Windows\ListeningGraphical	cbe9ac361320c689ea74990eb5b752c63b9bfec9deeb09ce7cfaaafb6baf41ef.exe
File opened for modification	C:\Windows\OverviewPoliticians	cbe9ac361320c689ea74990eb5b752c63b9bfec9deeb09ce7cfaaafb6baf41ef.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbe9ac361320c689ea74990eb5b752c63b9bfec9deeb09ce7cfaaafb6baf41ef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Immigrants.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Immigrants.pif
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Immigrants.pif

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1704	timeout.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Immigrants.pif
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Immigrants.pif
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Immigrants.pif

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2708	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2944	tasklist.exe
Token: SeDebugPrivilege	2476	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1148	Immigrants.pif
1148	Immigrants.pif
1148	Immigrants.pif

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 988	2936	cbe9ac361320c689ea74990eb5b752c63b9bfec9deeb09ce7cfaaafb6baf41ef.exe	30
PID 2936 wrote to memory of 988	2936	cbe9ac361320c689ea74990eb5b752c63b9bfec9deeb09ce7cfaaafb6baf41ef.exe	30
PID 2936 wrote to memory of 988	2936	cbe9ac361320c689ea74990eb5b752c63b9bfec9deeb09ce7cfaaafb6baf41ef.exe	30
PID 2936 wrote to memory of 988	2936	cbe9ac361320c689ea74990eb5b752c63b9bfec9deeb09ce7cfaaafb6baf41ef.exe	30
PID 988 wrote to memory of 2944	988	cmd.exe	32
PID 988 wrote to memory of 2944	988	cmd.exe	32
PID 988 wrote to memory of 2944	988	cmd.exe	32
PID 988 wrote to memory of 2944	988	cmd.exe	32
PID 988 wrote to memory of 2248	988	cmd.exe	33
PID 988 wrote to memory of 2248	988	cmd.exe	33
PID 988 wrote to memory of 2248	988	cmd.exe	33
PID 988 wrote to memory of 2248	988	cmd.exe	33
PID 988 wrote to memory of 2476	988	cmd.exe	35
PID 988 wrote to memory of 2476	988	cmd.exe	35
PID 988 wrote to memory of 2476	988	cmd.exe	35
PID 988 wrote to memory of 2476	988	cmd.exe	35
PID 988 wrote to memory of 2736	988	cmd.exe	36
PID 988 wrote to memory of 2736	988	cmd.exe	36
PID 988 wrote to memory of 2736	988	cmd.exe	36
PID 988 wrote to memory of 2736	988	cmd.exe	36
PID 988 wrote to memory of 2824	988	cmd.exe	37
PID 988 wrote to memory of 2824	988	cmd.exe	37
PID 988 wrote to memory of 2824	988	cmd.exe	37
PID 988 wrote to memory of 2824	988	cmd.exe	37
PID 988 wrote to memory of 2828	988	cmd.exe	38
PID 988 wrote to memory of 2828	988	cmd.exe	38
PID 988 wrote to memory of 2828	988	cmd.exe	38
PID 988 wrote to memory of 2828	988	cmd.exe	38
PID 988 wrote to memory of 2868	988	cmd.exe	39
PID 988 wrote to memory of 2868	988	cmd.exe	39
PID 988 wrote to memory of 2868	988	cmd.exe	39
PID 988 wrote to memory of 2868	988	cmd.exe	39
PID 988 wrote to memory of 1148	988	cmd.exe	40
PID 988 wrote to memory of 1148	988	cmd.exe	40
PID 988 wrote to memory of 1148	988	cmd.exe	40
PID 988 wrote to memory of 1148	988	cmd.exe	40
PID 988 wrote to memory of 2632	988	cmd.exe	41
PID 988 wrote to memory of 2632	988	cmd.exe	41
PID 988 wrote to memory of 2632	988	cmd.exe	41
PID 988 wrote to memory of 2632	988	cmd.exe	41
PID 1148 wrote to memory of 2684	1148	Immigrants.pif	42
PID 1148 wrote to memory of 2684	1148	Immigrants.pif	42
PID 1148 wrote to memory of 2684	1148	Immigrants.pif	42
PID 1148 wrote to memory of 2684	1148	Immigrants.pif	42
PID 1148 wrote to memory of 2760	1148	Immigrants.pif	44
PID 1148 wrote to memory of 2760	1148	Immigrants.pif	44
PID 1148 wrote to memory of 2760	1148	Immigrants.pif	44
PID 1148 wrote to memory of 2760	1148	Immigrants.pif	44
PID 2684 wrote to memory of 2708	2684	cmd.exe	46
PID 2684 wrote to memory of 2708	2684	cmd.exe	46
PID 2684 wrote to memory of 2708	2684	cmd.exe	46
PID 2684 wrote to memory of 2708	2684	cmd.exe	46
PID 1148 wrote to memory of 2360	1148	Immigrants.pif	49
PID 1148 wrote to memory of 2360	1148	Immigrants.pif	49
PID 1148 wrote to memory of 2360	1148	Immigrants.pif	49
PID 1148 wrote to memory of 2360	1148	Immigrants.pif	49
PID 2360 wrote to memory of 1704	2360	cmd.exe	51
PID 2360 wrote to memory of 1704	2360	cmd.exe	51
PID 2360 wrote to memory of 1704	2360	cmd.exe	51
PID 2360 wrote to memory of 1704	2360	cmd.exe	51

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\cbe9ac361320c689ea74990eb5b752c63b9bfec9deeb09ce7cfaaafb6baf41ef.exe
  "C:\Users\Admin\AppData\Local\Temp\cbe9ac361320c689ea74990eb5b752c63b9bfec9deeb09ce7cfaaafb6baf41ef.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move Attack Attack.bat & Attack.bat
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2944
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa opssvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2248
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2476
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2736
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 352562
      4⤵
      System Location Discovery: System Language Discovery
      PID:2824
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "MeantDependenceFavorSsl" Prot
      4⤵
      System Location Discovery: System Language Discovery
      PID:2828
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Hart + ..\Matter + ..\Sisters + ..\Safer + ..\Non + ..\Correctly + ..\Genius + ..\Grams t
      4⤵
      System Location Discovery: System Language Discovery
      PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\352562\Immigrants.pif
      Immigrants.pif t
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1148
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\EBFHJEGDAFHI" & exit
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2360
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1704
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      System Location Discovery: System Language Discovery
      PID:2632
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Ethiopia" /tr "wscript //B 'C:\Users\Admin\AppData\Local\NetBoost Dynamics\NetSwift.js'" /sc minute /mo 5 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Ethiopia" /tr "wscript //B 'C:\Users\Admin\AppData\Local\NetBoost Dynamics\NetSwift.js'" /sc minute /mo 5 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2708
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NetSwift.url" & echo URL="C:\Users\Admin\AppData\Local\NetBoost Dynamics\NetSwift.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NetSwift.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\352562\t

Filesize
540KB

MD5
86edbd880f76a23bbb3a7812e9b93405

SHA1
12bbc87ff3aabaa594f8f24d936588828980376b

SHA256
0041f91833a4303a3e75e8ab7b3251b942f74f24e5f854c44aec98fbabe9557d

SHA512
bb47c59b2cda429e4bad0430c400670e468ddaa47794e0685d10482012e1f6b270da6c391581b6feef94fae5067d1d24fbb3f3af1205225720fbd167e21c7294

Download Submit
C:\Users\Admin\AppData\Local\Temp\Attack

Filesize
18KB

MD5
00aea4a8b9f3b766fd94f8f1a1b17319

SHA1
fc1fb5b68f9c1272a725ce34e759e4d5504494ab

SHA256
93e3afd34454d916eda100343dab99b835335244ef658bb3910e214b8e593502

SHA512
aeb891407a6f478a1bb8a311f691477edb042cf34fdf14cef8d2f29d127101d469c6ea47beaa406edcb36c918c3ad6fe59771daa30342da5f853f58b84f4bb5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFAF4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Correctly

Filesize
78KB

MD5
7ae5ac8822aa91b8be9fbb9442f1bdb8

SHA1
8237ee080e41d70a23b286515c2f55736d8403cf

SHA256
a60f9f651521202b9843c0be82742a3581b84872029b61c563e118e3fae4822c

SHA512
b4cccc6f8d93f0e94227b020c8b36c391bc103527e594d43d0d0587c792bbe9c670556772e0fa03b260c4469815cd1d2b22302262f5da22ef3bb59a4b6d3ac86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Genius

Filesize
60KB

MD5
81445707ac5434c8f1b4e0ca384f3578

SHA1
103f78ccbbbaafa4141aadbb6187a7cd4484774f

SHA256
bbaa32a77fc13229146a162cc80511aa4f3ea4246de5a681c6f8fd7885b477e4

SHA512
d732da9b0fbdbd679785b235a06212aa42f9e10f917fc32f52c691d953243c27a7bc23fc3d1f3832d5676434ed6ff58a42722444b7254876615a26d2570fc2ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Grams

Filesize
32KB

MD5
ccaa26f4b425aa2163dd6b36608a98e8

SHA1
930dfd31656d25e1019b300f7526fdb1b561e0b9

SHA256
a4bcfb095588bce9d19743929d056ea1ea1c2ec59b3133e7204ab6786d3bbac7

SHA512
50d3e491ab728e754e762bb50c5714f1da17f29c35955009618bb0b86649b96b895a9d42246b0a313688d223d005b73564293e8c00b464c23a2482a2ed818395

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hart

Filesize
52KB

MD5
854346263a86ce44eb077c47ee00b9db

SHA1
feed381febb09baf159bdf233f7cbc7070f2fb10

SHA256
1cf636cada860a4bb8abc6d16b6d3ad928f80195ecafac04ae1425dbb4251bcf

SHA512
7ee1a58290bae56d765b73751888fd4e3578c1711f709dd70098548738fc29d045fdb2de52a809f72742d70701130cf91c610bd8f5aeed2c39f198c435fdba78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Matter

Filesize
74KB

MD5
1056a72b26876ae6657a041d5ba79728

SHA1
e85610d5afab8dbdfbdac031857869c477bf88ba

SHA256
ecc9de6d16313f7a8f99571093d3e652dd59cd85529eb502868fd59b5a67fbbd

SHA512
67d6ef75f41d7e165f76024aa832d1cde3b411e54e3736c74dbb5effb2fe0293ac83ee7985a44fba339ee628784647c4ec8585596d70d95369bbaafb7a838d15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Non

Filesize
92KB

MD5
089c3d6be114c4d86c89a54f54c26a38

SHA1
da2bfb8178d464fba227a34c684fd341dd4e6857

SHA256
b8b5911debd53cf89aa7a476ced7028fa71f67372b8b9bc137d477e1ca402c29

SHA512
0369360e7ffa7e290b61db1bd3964e134d11b3c24ec8b4e001559327da7746853ee2277cad3edd03bb12bd8910ecb48da4d5787a2979a32e6dc7bb8d8c52acc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Prot

Filesize
7KB

MD5
d49d575158c071a7d97786d9090535e0

SHA1
7f4981401967c0233d9df348268d67bc5c332f30

SHA256
3dc5d274a11deaea821a92252e018613f575e3e999c651dc45561bae9817a1e6

SHA512
63c57c5caa02f24bbe074a1c7823722cf5b9b46a8f19e8ca29adecf5ae192fb4a7cfbec786477ca2db60fa057637fae3f7d3504dc72f7980f051cd58bbc1137b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Safer

Filesize
81KB

MD5
2127c81beeeff906fc84c2563dbc5677

SHA1
7a13814d6e45e742f2c8de3a7b35466570e1a13c

SHA256
8970dfcd04d4918fb3fdf62e3c2fe274f7feb535698b4bd4a1153b29180c49fc

SHA512
9be025e281eb16e2a0828134b60e273ff95d6f45de5ce99d72f3052401ed8d9ecbfd493687984ae7a477872dcd3f48df8d0630b4291d633f91b2845226564a2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Shine

Filesize
865KB

MD5
3e9a6c5f67b99a5e92ee1c97023333fd

SHA1
25e1071c2b489d37e0c55c1fe1e78344a08fd0df

SHA256
df3d57c52957b8f7179ec2e156917e2139aa3f31149d62b45fb9fb361f3edc87

SHA512
bb77200638d28645117ca53683297144a888d7d8e9defeef082a9c97f99ac9d8795fc3c5f265c12ba8ee2f89a8286183f3712f6a0493a31432d472779dde20e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sisters

Filesize
71KB

MD5
4ce2961be4eb3e17fcd5956bb5f76b0c

SHA1
8a186e94de25817744eac203f3465694ade54cc3

SHA256
eff6a194566835c2118761fbd2e636fb4a2f3a6e13bcaa0e9a9c19ffe5b393c4

SHA512
ec4799c9670f24f2518e3a5dfa95f7adc6a96f5f2ed00d49c36efde3da7f8363c0fb6842d738c23017d4200b90bc2b3b0bbe7c503514c37afbc31a5421e28b56

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFB64.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
\Users\Admin\AppData\Local\Temp\352562\Immigrants.pif

Filesize
872KB

MD5
18ce19b57f43ce0a5af149c96aecc685

SHA1
1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

SHA256
d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

SHA512
a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

Download Submit
memory/1148-40-0x0000000003C50000-0x0000000003EC6000-memory.dmp

Filesize
2.5MB

Download
memory/1148-42-0x0000000003C50000-0x0000000003EC6000-memory.dmp

Filesize
2.5MB

Download
memory/1148-41-0x0000000003C50000-0x0000000003EC6000-memory.dmp

Filesize
2.5MB

Download
memory/1148-38-0x0000000003C50000-0x0000000003EC6000-memory.dmp

Filesize
2.5MB

Download
memory/1148-183-0x0000000003C50000-0x0000000003EC6000-memory.dmp

Filesize
2.5MB

Download
memory/1148-202-0x0000000003C50000-0x0000000003EC6000-memory.dmp

Filesize
2.5MB

Download
memory/1148-222-0x000000000D930000-0x000000000DB8F000-memory.dmp

Filesize
2.4MB

Download
memory/1148-231-0x0000000003C50000-0x0000000003EC6000-memory.dmp

Filesize
2.5MB

Download
memory/1148-250-0x0000000003C50000-0x0000000003EC6000-memory.dmp

Filesize
2.5MB

Download
memory/1148-39-0x0000000003C50000-0x0000000003EC6000-memory.dmp

Filesize
2.5MB

Download
memory/1148-37-0x0000000003C50000-0x0000000003EC6000-memory.dmp

Filesize
2.5MB

Download
memory/1148-381-0x0000000003C50000-0x0000000003EC6000-memory.dmp

Filesize
2.5MB

Download
memory/1148-400-0x0000000003C50000-0x0000000003EC6000-memory.dmp

Filesize
2.5MB

Download
memory/1148-461-0x0000000003C50000-0x0000000003EC6000-memory.dmp

Filesize
2.5MB

Download
memory/1148-480-0x0000000003C50000-0x0000000003EC6000-memory.dmp

Filesize
2.5MB

Download