Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 09:49
Behavioral task
behavioral1
Sample
88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe
Resource
win10v2004-20240802-en
General
-
Target
88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe
-
Size
2.3MB
-
MD5
81ea5574893bea66072640f30c7c0060
-
SHA1
55309a096c4956c808cc5d8e327c6f75fafe24c4
-
SHA256
88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233a
-
SHA512
575bb135a237194cc62ec4f893e3c6c4b165160383be62cf5f6265c2c67928c102e1b75b82493fa4983b35909be3428a1908cb1cd47080c6c669c671fff498bb
-
SSDEEP
3072:6R+9MwiQ1/d0kzv4NmVcc18DM74+c9JDpdN3f5Bl5xoaq0jcp8HraqVmQdwuA:6RKMreKkzwNemDM7Ab3ix8F7wu
Malware Config
Extracted
vidar
https://t.me/edm0d
https://steamcommunity.com/profiles/76561199768374681
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
Signatures
-
Detect Vidar Stealer 2 IoCs
resource yara_rule behavioral2/memory/868-0-0x0000000000CF0000-0x0000000000F47000-memory.dmp family_vidar_v7 behavioral2/memory/868-16-0x0000000000CF0000-0x0000000000F47000-memory.dmp family_vidar_v7 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 5656 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 868 88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe 868 88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe 868 88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe 868 88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe 868 88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe 868 88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 868 wrote to memory of 5416 868 88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe 86 PID 868 wrote to memory of 5416 868 88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe 86 PID 868 wrote to memory of 5416 868 88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe 86 PID 5416 wrote to memory of 5656 5416 cmd.exe 88 PID 5416 wrote to memory of 5656 5416 cmd.exe 88 PID 5416 wrote to memory of 5656 5416 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe"C:\Users\Admin\AppData\Local\Temp\88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\88f413c96604670ea6b1184c236b390468e9d4b16d35ed02701409b4a6f0233aN.exe" & rd /s /q "C:\ProgramData\AFIDGDBGCAAF" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\timeout.exetimeout /t 103⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5656
-
-