Analysis
-
max time kernel
95s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 10:27
Behavioral task
behavioral1
Sample
noll.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
noll.exe
Resource
win10v2004-20241007-en
General
-
Target
noll.exe
-
Size
384KB
-
MD5
d78f753a16d17675fb2af71d58d479b0
-
SHA1
71bfc274f7c5788b67f7cfae31be255a63dcf609
-
SHA256
ad9c40c2644ff83e0edbc367c6e62be98c9632157433108c03379351fe7aeca5
-
SHA512
60f4ebe4226fae95f6f1767d6f5fff99f69a126f0c827384c51745c512f495b001051d4273ca23bc177ec2c0511ec7f9ae384e3a5e88e29ce278ac45a55a39b8
-
SSDEEP
6144:elqPvKpKJNJGyRlyY8aSp0Vbux0R4kF/Y/o8+:emRJNMalyjaO0Ix6BY/s
Malware Config
Extracted
vidar
11
2ee1445fc63bc20d0e7966867b13e0e1
https://steamcommunity.com/profiles/76561199780418869
https://t.me/ae5ed
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
Signatures
-
Detect Vidar Stealer 2 IoCs
resource yara_rule behavioral2/memory/3748-0-0x0000000000610000-0x0000000000886000-memory.dmp family_vidar_v7 behavioral2/memory/3748-16-0x0000000000610000-0x0000000000886000-memory.dmp family_vidar_v7 -
Vidar family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation noll.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language noll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 noll.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString noll.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4508 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3748 noll.exe 3748 noll.exe 3748 noll.exe 3748 noll.exe 3748 noll.exe 3748 noll.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3748 wrote to memory of 3776 3748 noll.exe 84 PID 3748 wrote to memory of 3776 3748 noll.exe 84 PID 3748 wrote to memory of 3776 3748 noll.exe 84 PID 3776 wrote to memory of 4508 3776 cmd.exe 86 PID 3776 wrote to memory of 4508 3776 cmd.exe 86 PID 3776 wrote to memory of 4508 3776 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\noll.exe"C:\Users\Admin\AppData\Local\Temp\noll.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\noll.exe" & rd /s /q "C:\ProgramData\AFHDAKJKFCFB" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\timeout.exetimeout /t 103⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4508
-
-