Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29-09-2024 01:40

General

  • Target

    ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe

  • Size

    5.4MB

  • MD5

    cb001c3f82f9c3386ac03c2718f69ca4

  • SHA1

    4cdf57dcdeb3c3ebbac40f7b5d8846da1a9b3f46

  • SHA256

    ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5

  • SHA512

    42508b96b9339e37766c25b4d826a4b5f2883ace5f51964f70457d33b636bfa1c1421a22751ec0bd856471fb85510512b48ca3486f5593a3720a6582d30f647e

  • SSDEEP

    98304:sZVMlgGcASSOZMajAIuvkD2Lec3PYs7ecbwJMpjva81bkKyNTR1eXzs0cF:AMaGwEaj4vxeMQmecbuTRkzs5

Malware Config

Extracted

Family

vidar

Version

11

Botnet

adff67a4d89d160d64a32272a3076979

C2

https://t.me/jamsemlg

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Extracted

Family

lumma

C2

https://reinforcenh.shop/api

https://stogeneratmns.shop/api

https://fragnantbui.shop/api

https://drawzhotdog.shop/api

https://vozmeatillu.shop/api

https://offensivedzvju.shop/api

https://ghostreedmnu.shop/api

https://gutterydhowi.shop/api

Extracted

Family

vidar

Version

11

Botnet

c8450254a9a0920212cb81ae7f386da3

C2

https://t.me/jamsemlg

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Signatures

  • Detect Vidar Stealer 16 IoCs
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe
    "C:\Users\Admin\AppData\Local\Temp\ef42f7622666c1999fd34ca34489da81a0bdfc38a9105deae3fb7086a78280d5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2764
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2732
      • C:\ProgramData\BFHDAEHDAK.exe
        "C:\ProgramData\BFHDAEHDAK.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1468
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          PID:2028
      • C:\ProgramData\CFHIIJDBKE.exe
        "C:\ProgramData\CFHIIJDBKE.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2504
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:1740
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BFBGCFCFHCFH" & exit
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2436
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 10
          4⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:444

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cf0f02de46de445d698776dc4a8e47d8

    SHA1

    6f502ca0e916261d951fea5589a4b6f174189063

    SHA256

    7f4f426d5e8eac23e9b0f92a7217231c946cf050bf449e2f2983eca19e8a8f2e

    SHA512

    a09f3fe24ac732de2e814f2c9acc2a65c62835c989b27dc9c1bfb400e9fa758a9e89c1d6b3bac0f364f4a264be51e851655645cce6ce810cb48d095d42305fb3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9b071581dfebf60cc3e97de0009eb1f7

    SHA1

    2e1a64e4f9327ba6765ece7b1a468a8f56000356

    SHA256

    a1178aa0bc6d7bd187c4c741193d3e2b13245bff1d7d73ce94437de7c45b03e2

    SHA512

    6952d6c1ae3436c562fa130f45fd2e23e5d368ed687cfdd75f72941ea067259ed5bea97c3a209771c4bc118854a2a97b95e1223cb933e11b8bdd1753d624cfd8

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5\76561199780418869[1].htm

    Filesize

    33KB

    MD5

    c98a6462e75fb848c7cd3e5203218bf9

    SHA1

    e80f10787b4536cd09a6a10032c131f5cee66e85

    SHA256

    f752a0905a011f2aa6c76190fe2dbd02c5531f56e40393b7d94ef52dbe14014e

    SHA512

    4ea9ce1339e10a3ba3183b588916f65f39e2e517b92fe24ab15243075bc3e811490c20a12e61b29c445d8e8a03bf5d887281d4f27da1b1dafc7e8cbcd7b7fe69

  • C:\Users\Admin\AppData\Local\Temp\Cab8FC3.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar8FD6.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \ProgramData\BFHDAEHDAK.exe

    Filesize

    371KB

    MD5

    052eafad306073dc67e384f1f371c415

    SHA1

    27b45865e79e48634533d3971ddf2a0164c4f3bb

    SHA256

    9136c32467cd79e8fdb7ea154540093c005c6cf636bc52d7af6caf170a1a828b

    SHA512

    ad82848aca1d1c7af997c35ebd7fa6a04d01b8d09ab89f6ebeb41fd3c1b147507d6a110602fa3b6a6087b3d1ccf30d9e81f2b76af431da28dc81f4b3c6bd032d

  • \ProgramData\CFHIIJDBKE.exe

    Filesize

    404KB

    MD5

    07beff810640c60bf60464f5e1efb5b0

    SHA1

    2af2ee421ae26a98f9775bfe46821ffb47b406d3

    SHA256

    2161f38eb7e940f7dadbf1cff93e3219846ad9dd1d181aceadddd9b1f549bf70

    SHA512

    1ed5082b2652d1253c13803c3607afe4befa564c03f1203a6ad157f0187482382d7a1438e34a95667495c89a6ebe020d838fe61ec7f697de865fc55a3b031fa5

  • memory/1468-344-0x0000000000DB0000-0x0000000000E10000-memory.dmp

    Filesize

    384KB

  • memory/1468-576-0x0000000073800000-0x0000000073EEE000-memory.dmp

    Filesize

    6.9MB

  • memory/1468-343-0x000000007380E000-0x000000007380F000-memory.dmp

    Filesize

    4KB

  • memory/1468-366-0x0000000073800000-0x0000000073EEE000-memory.dmp

    Filesize

    6.9MB

  • memory/1740-404-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

  • memory/1740-417-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

  • memory/1740-414-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

  • memory/1740-410-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

  • memory/1740-412-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

  • memory/1740-406-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

  • memory/1740-408-0x0000000000400000-0x0000000000676000-memory.dmp

    Filesize

    2.5MB

  • memory/2028-358-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2028-359-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2028-362-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2028-364-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2028-367-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2028-357-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2028-355-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2028-356-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2504-394-0x0000000001170000-0x00000000011DA000-memory.dmp

    Filesize

    424KB

  • memory/2732-16-0x0000000000400000-0x0000000000B77000-memory.dmp

    Filesize

    7.5MB

  • memory/2732-197-0x0000000000400000-0x0000000000B77000-memory.dmp

    Filesize

    7.5MB

  • memory/2732-5-0x0000000000400000-0x0000000000B77000-memory.dmp

    Filesize

    7.5MB

  • memory/2732-14-0x0000000000400000-0x0000000000B77000-memory.dmp

    Filesize

    7.5MB

  • memory/2732-4-0x0000000000400000-0x0000000000B77000-memory.dmp

    Filesize

    7.5MB

  • memory/2732-196-0x0000000000400000-0x0000000000B77000-memory.dmp

    Filesize

    7.5MB

  • memory/2732-174-0x0000000061E00000-0x0000000061EF3000-memory.dmp

    Filesize

    972KB

  • memory/2732-155-0x0000000000400000-0x0000000000B77000-memory.dmp

    Filesize

    7.5MB

  • memory/2732-10-0x0000000000400000-0x0000000000B77000-memory.dmp

    Filesize

    7.5MB

  • memory/2732-6-0x0000000000400000-0x0000000000B77000-memory.dmp

    Filesize

    7.5MB

  • memory/2732-270-0x0000000000400000-0x0000000000B77000-memory.dmp

    Filesize

    7.5MB

  • memory/2732-289-0x0000000000400000-0x0000000000B77000-memory.dmp

    Filesize

    7.5MB

  • memory/2732-233-0x0000000000400000-0x0000000000B77000-memory.dmp

    Filesize

    7.5MB

  • memory/2732-19-0x0000000000400000-0x0000000000B77000-memory.dmp

    Filesize

    7.5MB

  • memory/2732-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2732-7-0x0000000000400000-0x0000000000B77000-memory.dmp

    Filesize

    7.5MB

  • memory/2732-8-0x0000000000400000-0x0000000000B77000-memory.dmp

    Filesize

    7.5MB

  • memory/2764-0-0x0000000074AEE000-0x0000000074AEF000-memory.dmp

    Filesize

    4KB

  • memory/2764-3-0x0000000074AE0000-0x00000000751CE000-memory.dmp

    Filesize

    6.9MB

  • memory/2764-1-0x0000000000A50000-0x0000000000FBA000-memory.dmp

    Filesize

    5.4MB

  • memory/2764-17-0x0000000074AE0000-0x00000000751CE000-memory.dmp

    Filesize

    6.9MB