Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    89s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/10/2024, 15:46

General

  • Target

    13c42c85bbeaac50ca5cebc9433e1b12c7f2072a833f60c54d59375993af2ecc.exe

  • Size

    404KB

  • MD5

    10e555691e5bd8608d3afde0c81a61e4

  • SHA1

    37480fa81dca9c7fa109820b0b86ed3ec7258b04

  • SHA256

    13c42c85bbeaac50ca5cebc9433e1b12c7f2072a833f60c54d59375993af2ecc

  • SHA512

    e4280c7b1c114b5b3dba3caa976604c77e69a782ecbff6cdb4c21653016878f90c8bcebd336dd288721ec38f464cd2a78e1bfe0b886e0bcb8a5fd610836df291

  • SSDEEP

    6144:kyt602OmYh5I7KU9QPrVI5IgQ0jolIMaszHQTh1u1KjjY9tbCDdBNkioEO:kdt7YMOU2hkflq3jHihamE912kioEO

Malware Config

Extracted

Family

vidar

Version

11

Botnet

3c2b9e69b31bab816bc6aaf265216d69

C2

https://t.me/jamsemlg

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Signatures

  • Detect Vidar Stealer 7 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\13c42c85bbeaac50ca5cebc9433e1b12c7f2072a833f60c54d59375993af2ecc.exe
    "C:\Users\Admin\AppData\Local\Temp\13c42c85bbeaac50ca5cebc9433e1b12c7f2072a833f60c54d59375993af2ecc.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:388
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:1992
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:2824

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/388-0-0x000000007472E000-0x000000007472F000-memory.dmp

      Filesize

      4KB

    • memory/388-1-0x0000000000150000-0x00000000001BA000-memory.dmp

      Filesize

      424KB

    • memory/388-11-0x0000000074720000-0x0000000074ED0000-memory.dmp

      Filesize

      7.7MB

    • memory/388-34-0x0000000074720000-0x0000000074ED0000-memory.dmp

      Filesize

      7.7MB

    • memory/2824-3-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2824-8-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2824-6-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2824-15-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2824-16-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2824-17-0x0000000022390000-0x00000000225EF000-memory.dmp

      Filesize

      2.4MB

    • memory/2824-32-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2824-33-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB