Analysis
-
max time kernel
97s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 14:11
Static task
static1
Behavioral task
behavioral1
Sample
42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe
Resource
win10v2004-20241007-en
General
-
Target
42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe
-
Size
323KB
-
MD5
34f45d20fef7dd9c8e8d7f5b9d5fa6a7
-
SHA1
4270a1cf22a0183d772bf143bec8a81b8b4ac51e
-
SHA256
42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74
-
SHA512
11a4e65e08a6f948336971e612f859429c4c58c6443ba85fc3b7a5165040bde57555c596a8c0322cd71b8e1fa3758dd7f6a247de5197b32212d9a90c37fe2410
-
SSDEEP
6144:bspY93m4ezZF197TvhhFUJi7AuRQ1zkIFZQRhtinsoCiiEI+:bWym4ezxLhKAkuRQtkIjQRGns2iEz
Malware Config
Signatures
-
Detect Vidar Stealer 5 IoCs
resource yara_rule behavioral2/memory/4912-3-0x0000000000400000-0x0000000000639000-memory.dmp family_vidar_v7 behavioral2/memory/4912-2-0x0000000000400000-0x0000000000639000-memory.dmp family_vidar_v7 behavioral2/memory/4912-1-0x0000000000400000-0x0000000000639000-memory.dmp family_vidar_v7 behavioral2/memory/4912-11-0x0000000000400000-0x0000000000639000-memory.dmp family_vidar_v7 behavioral2/memory/4912-12-0x0000000000400000-0x0000000000639000-memory.dmp family_vidar_v7 -
Vidar family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2328 set thread context of 4912 2328 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe 85 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3628 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4912 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe 4912 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2328 wrote to memory of 3036 2328 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe 84 PID 2328 wrote to memory of 3036 2328 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe 84 PID 2328 wrote to memory of 3036 2328 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe 84 PID 2328 wrote to memory of 4912 2328 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe 85 PID 2328 wrote to memory of 4912 2328 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe 85 PID 2328 wrote to memory of 4912 2328 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe 85 PID 2328 wrote to memory of 4912 2328 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe 85 PID 2328 wrote to memory of 4912 2328 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe 85 PID 2328 wrote to memory of 4912 2328 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe 85 PID 2328 wrote to memory of 4912 2328 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe 85 PID 2328 wrote to memory of 4912 2328 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe 85 PID 2328 wrote to memory of 4912 2328 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe 85 PID 2328 wrote to memory of 4912 2328 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe 85 PID 4912 wrote to memory of 1396 4912 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe 86 PID 4912 wrote to memory of 1396 4912 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe 86 PID 4912 wrote to memory of 1396 4912 42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe 86 PID 1396 wrote to memory of 3628 1396 cmd.exe 88 PID 1396 wrote to memory of 3628 1396 cmd.exe 88 PID 1396 wrote to memory of 3628 1396 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe"C:\Users\Admin\AppData\Local\Temp\42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe"C:\Users\Admin\AppData\Local\Temp\42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe"2⤵PID:3036
-
-
C:\Users\Admin\AppData\Local\Temp\42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe"C:\Users\Admin\AppData\Local\Temp\42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\42226b9f119843f7ff26e7d50895564d59fe8bf8db1830047c86298d8bc22d74.exe" & rd /s /q "C:\ProgramData\89000ZCJ5XBI" & exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3628
-
-
-