Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2024, 15:58

General

  • Target

    Unlock_Tool_2.3.1.exe

  • Size

    602KB

  • MD5

    72162382680c702829c6ceed17d2e507

  • SHA1

    51324f4095fe73a99d080d9f0bba1c829430bb18

  • SHA256

    eaae82540ddec53797abee6d3bf507acace850f3fff7cb2a03b6a26ab0b5c46f

  • SHA512

    27787baedb4fafe7884369d9cafb762aaa540e8130c7acefd618c4fb40e1c3459bcfe94df5f1aadc1245fcb52900692f96200d021f5d3bd6087ab12c3661d397

  • SSDEEP

    12288:9/kD3wynB4WIz1hhnpF6SnU/wq0vWCfIBM+09d83nEO:SwynIPU/wqsWCfIdm6Xt

Malware Config

Extracted

Family

vidar

Version

11.1

Botnet

23a142269e47ce1692ccc9fb68473bc2

C2

https://steamcommunity.com/profiles/76561199786602107

https://t.me/lpnjoke

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Signatures

  • Detect Vidar Stealer 13 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe
    "C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe
      "C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe"
      2⤵
        PID:2688
      • C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe
        "C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe"
        2⤵
          PID:2696
        • C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe
          "C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe"
          2⤵
            PID:2796
          • C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe
            "C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe"
            2⤵
              PID:2800
            • C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe
              "C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe"
              2⤵
                PID:2816
              • C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe
                "C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe"
                2⤵
                  PID:2876
                • C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe
                  "C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe"
                  2⤵
                    PID:2956
                  • C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe
                    "C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe"
                    2⤵
                      PID:2700
                    • C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe
                      "C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.1.exe"
                      2⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Checks processor information in registry
                      • Modifies system certificate store
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:2656
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BGDAKEHIIDGD" & exit
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:1952
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout /t 10
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Delays execution with timeout.exe
                          PID:1032
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 120
                      2⤵
                      • Program crash
                      PID:2776

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

                    Filesize

                    1KB

                    MD5

                    a266bb7dcc38a562631361bbf61dd11b

                    SHA1

                    3b1efd3a66ea28b16697394703a72ca340a05bd5

                    SHA256

                    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                    SHA512

                    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

                    Filesize

                    242B

                    MD5

                    9ce15121b0d32afa178547bd02ee3d92

                    SHA1

                    fbd9065cb5e15b087eafd11436bc4ed36c52a059

                    SHA256

                    b16af83d200be12bf69f7e814d20111caed916436e96e9c88c71e8ddd6555b0d

                    SHA512

                    1e161b014df25fda9cb6db9226ba9b08acb94fe647ed0cf66859ada567acf3637d921da8219cb02e306d203b2556c7457d45502e73e58a9f9bc257810d46d879

                  • C:\Users\Admin\AppData\Local\Temp\Cab5ADF.tmp

                    Filesize

                    70KB

                    MD5

                    49aebf8cbd62d92ac215b2923fb1b9f5

                    SHA1

                    1723be06719828dda65ad804298d0431f6aff976

                    SHA256

                    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                    SHA512

                    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                  • C:\Users\Admin\AppData\Local\Temp\Tar5B01.tmp

                    Filesize

                    181KB

                    MD5

                    4ea6026cf93ec6338144661bf1202cd1

                    SHA1

                    a1dec9044f750ad887935a01430bf49322fbdcb7

                    SHA256

                    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                    SHA512

                    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                  • \ProgramData\mozglue.dll

                    Filesize

                    593KB

                    MD5

                    c8fd9be83bc728cc04beffafc2907fe9

                    SHA1

                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                    SHA256

                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                    SHA512

                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                  • \ProgramData\nss3.dll

                    Filesize

                    2.0MB

                    MD5

                    1cc453cdf74f31e4d913ff9c10acdde2

                    SHA1

                    6e85eae544d6e965f15fa5c39700fa7202f3aafe

                    SHA256

                    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                    SHA512

                    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                  • memory/2092-0-0x00000000002EB000-0x00000000002EC000-memory.dmp

                    Filesize

                    4KB

                  • memory/2656-233-0x0000000000400000-0x0000000000676000-memory.dmp

                    Filesize

                    2.5MB

                  • memory/2656-288-0x0000000000400000-0x0000000000676000-memory.dmp

                    Filesize

                    2.5MB

                  • memory/2656-1-0x0000000000400000-0x0000000000676000-memory.dmp

                    Filesize

                    2.5MB

                  • memory/2656-5-0x0000000000400000-0x0000000000676000-memory.dmp

                    Filesize

                    2.5MB

                  • memory/2656-6-0x0000000000400000-0x0000000000676000-memory.dmp

                    Filesize

                    2.5MB

                  • memory/2656-7-0x0000000000400000-0x0000000000676000-memory.dmp

                    Filesize

                    2.5MB

                  • memory/2656-155-0x0000000000400000-0x0000000000676000-memory.dmp

                    Filesize

                    2.5MB

                  • memory/2656-192-0x000000001E260000-0x000000001E4BF000-memory.dmp

                    Filesize

                    2.4MB

                  • memory/2656-12-0x0000000000400000-0x0000000000676000-memory.dmp

                    Filesize

                    2.5MB

                  • memory/2656-207-0x0000000000400000-0x0000000000676000-memory.dmp

                    Filesize

                    2.5MB

                  • memory/2656-16-0x0000000000270000-0x0000000000309000-memory.dmp

                    Filesize

                    612KB

                  • memory/2656-3-0x0000000000400000-0x0000000000676000-memory.dmp

                    Filesize

                    2.5MB

                  • memory/2656-8-0x0000000000400000-0x0000000000676000-memory.dmp

                    Filesize

                    2.5MB

                  • memory/2656-358-0x0000000000400000-0x0000000000676000-memory.dmp

                    Filesize

                    2.5MB

                  • memory/2656-377-0x0000000000400000-0x0000000000676000-memory.dmp

                    Filesize

                    2.5MB

                  • memory/2656-424-0x0000000000400000-0x0000000000676000-memory.dmp

                    Filesize

                    2.5MB

                  • memory/2656-447-0x0000000000400000-0x0000000000676000-memory.dmp

                    Filesize

                    2.5MB

                  • memory/2656-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                    Filesize

                    4KB

                  • memory/2656-13-0x0000000000400000-0x0000000000676000-memory.dmp

                    Filesize

                    2.5MB