Analysis
-
max time kernel
133s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-10-2024 12:25
General
-
Target
TradingView_Premium_Desktop_(password_github).zip
-
Size
135.3MB
-
MD5
22422d62b7a227bb310ece165bc91063
-
SHA1
8e56d4ee4c2102ba952d5ea46915aa465da1c6d6
-
SHA256
a6aac404891cb48e8f3a0f578b52be41422fb751e9d4d00f0115296b157c2890
-
SHA512
76db140bd39165ee6a778559467579e707b740bbf9c374806fd937f7518a0dc56fc10eaaf19949fb9133818b4b657882d18abfb131ca7d1ef5a14c92c5079f3b
-
SSDEEP
3145728:uph//jwxAQNKfMd8RGT0YrAqMlKYN3RAPX/Ms0TlrRJ7vQ:ChjwTrekT0YrAJIYon0TZQ
Malware Config
Signatures
-
Detect Vidar Stealer 8 IoCs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\TradingView_Premium_Desktop_(password_github).zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\TradingView_Premium_Desktop_(password_github)\" -spe -an -ai#7zMap23839:170:7zEvent131131⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\TradingView_Premium_Desktop_(password_github)\TradingView Premium Desktop.exe"C:\Users\Admin\AppData\Local\Temp\TradingView_Premium_Desktop_(password_github)\TradingView Premium Desktop.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\EHIDAKECFIEB" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 103⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\TradingView_Premium_Desktop_(password_github)\TradingView Premium Desktop.exe"C:\Users\Admin\AppData\Local\Temp\TradingView_Premium_Desktop_(password_github)\TradingView Premium Desktop.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\TradingView_Premium_Desktop_(password_github)\TradingView Premium Desktop.exe"C:\Users\Admin\AppData\Local\Temp\TradingView_Premium_Desktop_(password_github)\TradingView Premium Desktop.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Downloads\w\TradingView Premium Desktop.exe"C:\Users\Admin\Downloads\w\TradingView Premium Desktop.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Users\Admin\Downloads\w\TradingView Premium Desktop.exe"C:\Users\Admin\Downloads\w\TradingView Premium Desktop.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5066a537b995fe292f153bf37fa7386f2
SHA1c63888164ad71f8b619d22bffb3348d7d4f386ee
SHA2564c0eb0dbe16a4ed706ca649c8e220fda74472fd5275cdbd2fab2bcf17eb34a89
SHA5123c68949672b34ef560518721e034883758ac2248bbb1fcd390477494cb4b319d709a8bcad1376428f8d96736c3406677a10512eb59ec804f8ee0970fe3780c08
-
Filesize
471B
MD5932a53c8f40fe40a68ceb03eec999118
SHA118e8d6eb94d23d7d3509318bcb5312069fd1ddbf
SHA25672a781ad178dcc1a694e056987a851efc5bd747863d01ff2969c3c40e16904f0
SHA51298bd8d6b7182131f05552699767f0d13c3d3777ba6973b35c674477a9bd224dd47829d6c9d809a74310277649ce3b851c8b0cdf9b1c266b104835c18f28fa808
-
Filesize
400B
MD509488b6c127f70dc9c53594fcd60f6d0
SHA106687788503598d32d834a1b26937408314755f0
SHA2560b5046ed8a90b3ffc9229d7b4e7f0bf6e65499d015ef723f41a0b071d5ddbc16
SHA512019b52a92b9096100d57179669148ba02429c8b6444b4d57e2402584533d3dc424c01a60e61985fd116f8fca2bb85afe86e4b2cc3f74ba87c20e9c37fca7705a
-
Filesize
34KB
MD5c40bf04025e97c07cd2f0eb965ddfb4f
SHA1c5904446e2906035106601334c8dc8a7370b79a2
SHA256d3a923d6f5dbc66bf8deefdc0407d495ce027d32ccd7a1b7781b3e43297fab07
SHA5123bf27f45eddbd483912b5764a72084e6f02d35733805fdac19da46fb0c1ad7800b49099620975de146682e60720b08fed19ab299497dc5f49aa1bf6678c40050
-
Filesize
34KB
MD5b2fbcaba7aeea0b14284bf9f6003565e
SHA15ffb0b471c475347b6e7b6eb5d653fded662ad19
SHA256a74eb34b63e8dd80ac74df07ab1a4456732cdd91d43be7dbf0a54bfacbc70ec3
SHA512d1e1d7225f9f8d0ce16b04eaf68a25f8a6808dc792fefabb3709ad4806b95ba31b8ab51244c0ff3dcda5ede1711778399dee969a0bd7b9877f89a69bdc2483b1
-
Filesize
34KB
MD5febaf3bd6d46d72b01ed76303494e7db
SHA130b5814b00c34ae66a5f4879622b0638fd4e34c7
SHA2563ae027b8b746ffe07074dc4484f96acef84d9fb590d44c08595ae47a4e508bea
SHA512de0fd21ba3027fc0a7dbe0cb2ab0a8e2de8146b6e6ea5adfd889b00aa8da47062424150edf23b39b9e69b4c52361f7fdeed907d861c5379a8a25c7d54fb6a4d6
-
Filesize
34KB
MD52b604569499993eda5717c9317502747
SHA1168a16584f0e7e7cf8519138740c48658405d695
SHA2569c5262981a74a71b22049a3c4c168847d7d3893007f30e9256490ed4a031e0a6
SHA512d66c4db82009d958f6fe08c5ac212b17c8c5c38726c797480263b295c42d6a1bd2d6d275184209858797456cdc9fe573e524bdbe7a0310983c4f3997cdfd5fb1
-
Filesize
34KB
MD50b1d5432bdebc0b195ecdcb2a10a0d7d
SHA12fb9b2e0f89750b8119e81f429c76d0fbe91941f
SHA2561cfb2402299a34eadc5be0059a155dd4a8480ba807200b13495afaf677f510af
SHA51293745f5a678ba611fc224879b7dad6996c62fdf026177f269cbe950234edfcb6a8d0830dd1b68ea7012073a071dc8ceca929294fb27e1c741d9cdf2e61b42047
-
Filesize
23KB
MD55e54cb9759d1a9416f51ac1e759bbccf
SHA11a033a7aae7c294967b1baba0b1e6673d4eeefc6
SHA256f7e5cae32e2ec2c35346954bfb0b7352f9a697c08586e52494a71ef00e40d948
SHA51232dcca4432ec0d2a8ad35fe555f201fef828b2f467a2b95417b42ff5b5149aee39d626d244bc295dca8a00cd81ef33a20f9e681dd47eb6ee47932d5d8dd2c664
-
Filesize
19.7MB
-
Filesize
19.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
19.7MB
-
Filesize
19.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
19.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
19.7MB
-
Filesize
4KB
-
Filesize
19.7MB
-
Filesize
972KB
-
Filesize
19.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
19.7MB
-
Filesize
19.7MB