Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
15-10-2024 19:06
General
-
Target
https://coincapy.com/get_tw/
Malware Config
Signatures
-
Detect Vidar Stealer 2 IoCs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Executes dropped EXE 1 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 4 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Modifies registry class 64 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "https://coincapy.com/get_tw/"1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\TradingView_Premium_Desktop_(password_github)\" -spe -an -ai#7zMap27348:148:7zEvent105681⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\TradingView_Premium_Desktop_(password_github)\TradingView Premium Desktop.exe"C:\Users\Admin\Desktop\TradingView_Premium_Desktop_(password_github)\TradingView Premium Desktop.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\CGCFCBAKKFBF" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 103⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD51bfe591a4fe3d91b03cdf26eaacd8f89
SHA1719c37c320f518ac168c86723724891950911cea
SHA2569cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA51202f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
-
Filesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
239KB
MD5051252bd8b5c359e84c2067b857eb9a8
SHA1021ab21c7d6b9fc2a8d5646d472d97e792a775e1
SHA256f13aa1cf3bdf81dc4220e289b63fc5a772fe7e6286d20fb278168ed139ea9e20
SHA51212b4054fef5d279936eb6a30377b2780c838df1f3feeb0e39afdf5d1a81dc4c4e4157ebb362b64e1748966f09d80414c118181219eee76872fd27c254066de3a
-
Filesize
11KB
MD507cf3e505b9c844de73d54d0159e55ec
SHA13db89b017a4ca9ed90ae1297dc25ffd7dde5df63
SHA256c80b4a4bcc21fe489e877d8cc7b3f3cfe4943801c4bc899a0f3c82244fa0f28a
SHA5122b954d025a2278a459445fe809d3ff425797220ed500dfac120991bc1130fbafc4d5025b790aa4d1e84d8d1897f50608b3b3d9e9c111f95bface79d8791bbd3b
-
Filesize
18B
MD51f2cb924ab7c6c964d77c6a61098ff57
SHA1efa42f9dc9d3c95179613c1afabd7906e86d4a42
SHA25616f191e6355d32099b7f25945270f621bef6f92b3e5c1da178bc21e60912b470
SHA5127aa55921af23ae4b9456cd3317391c8d8b927e266ef41a0e41c89a68798d7c53c62f730ee71977f3d465be3c8510a68e5ebabde73ea183b4c94af867daa209a7
-
Filesize
13KB
MD55331bac43e1da20a9cf5b9bd4ee4f83a
SHA183f5cd92320abc367e4215f98c78ecaedec5f56b
SHA256fba02491e20b9de7ed50476145904f4a130aa2ad6de15c4e55b63368263f6fe8
SHA5120806679ecb8c5ea459092cbf7d5b030ed41eb596399f95770f5b4e95b3a70f46b8099c29cbfab292398b0bc03e76b0ad049a29ecb49b7aff81bca84dede4d2a8
-
Filesize
23KB
MD55e54cb9759d1a9416f51ac1e759bbccf
SHA11a033a7aae7c294967b1baba0b1e6673d4eeefc6
SHA256f7e5cae32e2ec2c35346954bfb0b7352f9a697c08586e52494a71ef00e40d948
SHA51232dcca4432ec0d2a8ad35fe555f201fef828b2f467a2b95417b42ff5b5149aee39d626d244bc295dca8a00cd81ef33a20f9e681dd47eb6ee47932d5d8dd2c664
-
Filesize
13KB
MD53666ab3b60d527211ba53203bef9f911
SHA1f63f946eb36414c845b4faa826379b5d84fd8f11
SHA2569cfec87cb1fe913126aa50811a09d34f494d9917b2958ed2b9056744aed26a35
SHA512bb5c4515ae0fbf10094e638ac6ddd033a6c72398ded656e02448aaff77e4c5c936a7584fd66b9838e66edd5b85d0c7de3dd456422c3a0a9348b87d2b24c47eed
-
Filesize
25B
MD5975f1a1e9506cb4ecf67908349f93d70
SHA1b4ef860be2eb4b48beec790fa24aa93e75e526d6
SHA256b574e73c5c3f65df0099e958fc5b9959738daae7b2b8854e78815ccb08f564a8
SHA512aee94612c838beed21be31f04482440a0357f5de9d1e426cc7ef0dd2deff9c15a912d19b0e83c10cfbeea044dcdf5b45e582a16e8a0e5027a133c885dde602f0
-
Filesize
36KB
MD5839cdfa87b30840faaa1d05f3f0014b6
SHA117c218e688e8c3176869dcab452ca362404f8bc6
SHA256c53071322a5d6e161ef5105fbb5ee4129a848e0bcb1ecb0dbba11d351ad1cf13
SHA512ade8eb1e2a1e1dfe3ea7b3f0b7fe28b06e3996a39b4d17164708d434f07967fd8809418ed5a0c4ff1f8b0fe0bc276e8c773e030f361fe9fb09d75e3e2e607550
-
Filesize
17KB
MD5015500391eecb049e857b8b354bb8aa9
SHA1d4a886b73c656a3aec5e31364281ac1005acfd05
SHA25680a47b479eaa4807a7a0fad4398b65fa830542802e00b9293660107a091d8aae
SHA512977aeb8ed179393b0ad06ec08e78edcfb220c60ff123b5bed8b444f102fc8279579cadbc287cd3dc8d29054c7d4f903eafcd6640df251b8de9675b7dc6c17b72
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
19.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
19.7MB
-
Filesize
972KB
-
Filesize
19.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB