Overview
overview
10Static
static
10Samples - ...24.zip
windows11-21h2-x64
1Samples - ...a1.exe
windows11-21h2-x64
10Samples - ...8b.exe
windows11-21h2-x64
10Samples - ...c2.dll
windows11-21h2-x64
1Samples - ...b5.exe
windows11-21h2-x64
10Samples - ...56.exe
windows11-21h2-x64
10Samples - ...57.exe
windows11-21h2-x64
1Samples - ...cb.exe
windows11-21h2-x64
10Samples - ...69.exe
windows11-21h2-x64
10Samples - ...0c.exe
windows11-21h2-x64
10Samples - ...9b.exe
windows11-21h2-x64
1Samples - ...64.exe
windows11-21h2-x64
1Samples - ...48.exe
windows11-21h2-x64
1Samples - ...d4.exe
windows11-21h2-x64
1Samples - ...3f.exe
windows11-21h2-x64
10Samples - ...dd.exe
windows11-21h2-x64
10Samples - ...3d.exe
windows11-21h2-x64
10Samples - ...fd.exe
windows11-21h2-x64
10Samples - ...a1.exe
windows11-21h2-x64
10Samples - ...cc.exe
windows11-21h2-x64
10Samples - ...51.exe
windows11-21h2-x64
10Samples - ...8b.exe
windows11-21h2-x64
10Samples - ...39.exe
windows11-21h2-x64
10Samples - ...d0.exe
windows11-21h2-x64
5Samples - ...75.exe
windows11-21h2-x64
3Samples - ...c7.exe
windows11-21h2-x64
5Samples - ...76.exe
windows11-21h2-x64
10Samples - ...bc.exe
windows11-21h2-x64
10Samples - ...b9.exe
windows11-21h2-x64
3Samples - ...f7.exe
windows11-21h2-x64
3Samples - ...2b.exe
windows11-21h2-x64
3Samples - ...22.exe
windows11-21h2-x64
10Resubmissions
10-10-2024 02:19
241010-crx4sazhnm 10Analysis
-
max time kernel
74s -
max time network
141s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
10-10-2024 02:19
Static task
static1
Behavioral task
behavioral1
Sample
Samples - 10-09-2024.zip
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
Samples - 10-09-2024/4311121804332b647e02280a9c551c85c16a46f24f2d2107a9bdceaa8923afa1.exe
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
Samples - 10-09-2024/44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b.exe
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
Samples - 10-09-2024/44f5ebb4facaba45274f08437a1f980bbbdb209cbd016ead76e4ec1afaca4dc2.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
Samples - 10-09-2024/4529554d09a020003227f1d879f6e202604c5875b89b9c3088a32c65211182b5.exe
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
Samples - 10-09-2024/45aae4515b7076d25923730c3672cb9e8f462cf402828fd3eb2d3255d626df56.exe
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
Samples - 10-09-2024/45b33888ddb2748434643e4811f156f1fc2a5d339d3577945d8c9e9d88c5ff57.exe
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
Samples - 10-09-2024/45ba5f7c168cfa2a68d8f8d448ee037d35fca5dbb7e9d4deb55f8e0ba97ceacb.exe
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
Samples - 10-09-2024/46173d25c61f353cb1c5047b6108cae5d4eb30bf24e9981dfc94f78b85f92c69.exe
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
Samples - 10-09-2024/462fafaa4badf6b5bba91bd555eb567db6be610a72d7efd8f039e9387924480c.exe
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
Samples - 10-09-2024/46936b0fef991d2d3ee9af2d07d2a90f0cc8260fa2ade9d661c197319798d89b.exe
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
Samples - 10-09-2024/47cf5e11cfe6184962783d4a21d7d35cd057ec8ca299c8c5fe69673a03fe5364.exe
Resource
win11-20241007-en
Behavioral task
behavioral13
Sample
Samples - 10-09-2024/49572fa3d9a71986235bda85410e9af9d4a6f087cc477e3813551a3789cdd148.exe
Resource
win11-20241007-en
Behavioral task
behavioral14
Sample
Samples - 10-09-2024/499d69d5ab8ba263975d5780e3b639a2a8905c50f2a1379bf972889c3913add4.exe
Resource
win11-20241007-en
Behavioral task
behavioral15
Sample
Samples - 10-09-2024/499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe
Resource
win11-20241007-en
Behavioral task
behavioral16
Sample
Samples - 10-09-2024/4a16685ec6d408bafc872fac39012bb670ff7bba818a7af9f7dd411a383869dd.exe
Resource
win11-20241007-en
Behavioral task
behavioral17
Sample
Samples - 10-09-2024/4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
Resource
win11-20241007-en
Behavioral task
behavioral18
Sample
Samples - 10-09-2024/4acf2f8eeb71da00b6b5356b63c472157b7e0936f1f7b8f5a06aa295482319fd.exe
Resource
win11-20241007-en
Behavioral task
behavioral19
Sample
Samples - 10-09-2024/4ad7e405f5bcbfdf1cc163212428a779fa7d890a46500f579103333722986aa1.exe
Resource
win11-20241007-en
Behavioral task
behavioral20
Sample
Samples - 10-09-2024/4b6be11fd5704e5489c7911c1659f1bb7f9901e2d5c70c2f8f126512071093cc.exe
Resource
win11-20241007-en
Behavioral task
behavioral21
Sample
Samples - 10-09-2024/4ceb69afc05b1475459075f2cd5688f6aa8fe6a9ff6cae0a25d742b650c62351.exe
Resource
win11-20241007-en
Behavioral task
behavioral22
Sample
Samples - 10-09-2024/4d0b50e69d551bf15ec0a44c8471f8766ca5b98bd3b462c3bf0e976c76c1308b.exe
Resource
win11-20241007-en
Behavioral task
behavioral23
Sample
Samples - 10-09-2024/4e20a0aa3d323c0a1aa676c7eb3656cdd34cb69da614b4dc8aa946f5bcb2be39.exe
Resource
win11-20241007-en
Behavioral task
behavioral24
Sample
Samples - 10-09-2024/4e2c78a6bef2caef536cf00c467a54a7081adc8118e7741043e243c0eb4843d0.exe
Resource
win11-20241007-en
Behavioral task
behavioral25
Sample
Samples - 10-09-2024/4e3b746d859d34f64c28a2079f76f84d3c46b65907f52cb3da7d0ddd2c0dc875.exe
Resource
win11-20240802-en
Behavioral task
behavioral26
Sample
Samples - 10-09-2024/4eae876a9c21fadb647a6fe14c83272189ace267ebed4b320c73da14e095dec7.exe
Resource
win11-20241007-en
Behavioral task
behavioral27
Sample
Samples - 10-09-2024/4ed6d72fef68c583439e803871226e76588ce6436d10362011b21763e0ccf176.exe
Resource
win11-20241007-en
Behavioral task
behavioral28
Sample
Samples - 10-09-2024/4f43043ac4f71ee0f3416e75534ab2616ae90eb887a083b6f2e39995b334c2bc.exe
Resource
win11-20241007-en
Behavioral task
behavioral29
Sample
Samples - 10-09-2024/4f432ba1da38c64c9298fb2c2a0271c06dc333fb66e7f2b6deebf1ec6782c6b9.exe
Resource
win11-20241007-en
Behavioral task
behavioral30
Sample
Samples - 10-09-2024/4fa525bb40e57606312d30bcc45e697e6c92e9826e4ece20a5f74af64c22a5f7.exe
Resource
win11-20241007-en
Behavioral task
behavioral31
Sample
Samples - 10-09-2024/5030cfa10a9c06fbe2182aea828e449850e49c9f437c17e5bf8f7b634c48cd2b.exe
Resource
win11-20241007-en
Behavioral task
behavioral32
Sample
Samples - 10-09-2024/504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822.exe
Resource
win11-20241007-en
General
-
Target
Samples - 10-09-2024/44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b.exe
-
Size
282KB
-
MD5
f31d21c664ded57509d1e2e1e2c73098
-
SHA1
58abbe186f2324eca451d3866b63ceeb924d3391
-
SHA256
44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b
-
SHA512
5aff27d9ffb0568072f52e51679bbd9cb3c063d7bb1c3fe658c10241b633a66738d6bd7ee2111e065a1b93098bdaa1e5da6b9b8d063fe3f1ff1de7d71d32aa53
-
SSDEEP
6144:GsbHGb3gHx2vdWxR5TjWfEvi3v+QwzmGEO:iPvoxR5WfEveSKGEO
Malware Config
Extracted
vidar
https://t.me/edm0d
https://steamcommunity.com/profiles/76561199768374681
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
Signatures
-
Detect Vidar Stealer 5 IoCs
resource yara_rule behavioral3/memory/2044-6-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral3/memory/2044-10-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral3/memory/2044-7-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral3/memory/2044-27-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral3/memory/2044-28-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3500 set thread context of 2044 3500 44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b.exe 82 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2448 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2044 RegAsm.exe 2044 RegAsm.exe 2044 RegAsm.exe 2044 RegAsm.exe 2044 RegAsm.exe 2044 RegAsm.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3500 wrote to memory of 2044 3500 44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b.exe 82 PID 3500 wrote to memory of 2044 3500 44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b.exe 82 PID 3500 wrote to memory of 2044 3500 44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b.exe 82 PID 3500 wrote to memory of 2044 3500 44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b.exe 82 PID 3500 wrote to memory of 2044 3500 44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b.exe 82 PID 3500 wrote to memory of 2044 3500 44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b.exe 82 PID 3500 wrote to memory of 2044 3500 44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b.exe 82 PID 3500 wrote to memory of 2044 3500 44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b.exe 82 PID 3500 wrote to memory of 2044 3500 44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b.exe 82 PID 3500 wrote to memory of 2044 3500 44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b.exe 82 PID 2044 wrote to memory of 848 2044 RegAsm.exe 84 PID 2044 wrote to memory of 848 2044 RegAsm.exe 84 PID 2044 wrote to memory of 848 2044 RegAsm.exe 84 PID 848 wrote to memory of 2448 848 cmd.exe 86 PID 848 wrote to memory of 2448 848 cmd.exe 86 PID 848 wrote to memory of 2448 848 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Samples - 10-09-2024\44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b.exe"C:\Users\Admin\AppData\Local\Temp\Samples - 10-09-2024\44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & rd /s /q "C:\ProgramData\FHIDAFHCBAKF" & exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2448
-
-
-