Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2024, 00:30
Static task
static1
Behavioral task
behavioral1
Sample
09362cad6ac71a2068e2603345a93960efd09ee21300b534029185f0255997b4.exe
Resource
win7-20240903-en
General
-
Target
09362cad6ac71a2068e2603345a93960efd09ee21300b534029185f0255997b4.exe
-
Size
743KB
-
MD5
94cab93a2cbfcc9cc2dc717bfb3cdf65
-
SHA1
7574be21199394deab77af6372bcbeb1ff912b6c
-
SHA256
09362cad6ac71a2068e2603345a93960efd09ee21300b534029185f0255997b4
-
SHA512
22752fc814531f9529bef3713624a25ae5bbdd9d4ffc11a232ae485570e2b3fb2bd0ce92ed6c65431c22f231b3e38b113527abab47d2b3aae002fca995e56e21
-
SSDEEP
12288:cZaoSlqdoJwS32yxxKrkiJKzQ2aihPX8WQ4Bkpbk6rdZd+M/tYLoXMGp/hVBfqJx:cNvOf2CxK7J0QI5Q4epIEvTeYMGRopkE
Malware Config
Extracted
vidar
41.3
1008
https://mas.to/@oleg98
-
profile_id
1008
Signatures
-
Vidar family
-
Vidar Stealer 5 IoCs
resource yara_rule behavioral2/memory/2296-2-0x00000000033F0000-0x00000000034C6000-memory.dmp family_vidar behavioral2/memory/2296-3-0x0000000000400000-0x00000000004D9000-memory.dmp family_vidar behavioral2/memory/2296-11-0x00000000033F0000-0x00000000034C6000-memory.dmp family_vidar behavioral2/memory/2296-12-0x0000000000400000-0x00000000004D9000-memory.dmp family_vidar behavioral2/memory/2296-10-0x0000000000400000-0x000000000172D000-memory.dmp family_vidar -
Program crash 1 IoCs
pid pid_target Process procid_target 5000 2296 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 09362cad6ac71a2068e2603345a93960efd09ee21300b534029185f0255997b4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09362cad6ac71a2068e2603345a93960efd09ee21300b534029185f0255997b4.exe"C:\Users\Admin\AppData\Local\Temp\09362cad6ac71a2068e2603345a93960efd09ee21300b534029185f0255997b4.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2296 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 10282⤵
- Program crash
PID:5000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2296 -ip 22961⤵PID:4904