Analysis
-
max time kernel
190s -
max time network
192s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25/01/2025, 13:32
General
-
Target
241105-dtxrgatbpg_pw_infected.zip
-
Size
132.7MB
-
MD5
136b5aad00be845ec166ae8f6343b335
-
SHA1
e51860dfb734c9715b6c9b74d9c582abe03ca90c
-
SHA256
38bc13ef112b2f17d4d1a80243fac6a521b5d58228984aae0752d79487fa3b66
-
SHA512
ed56b1afa85e304d6973d69e289631f15955d1619c6943a376d7d319018057d1a6fa0aa340ea6d43037ee17014f13e74e5ebddaf3aec62bf8e2da6b20b14ce42
-
SSDEEP
3145728:m2t5SZQXkJuAwd3u5d5VO4Z9WSXL5qgP47khuJWCvcICllCCrE/z:m6ClwdeyqWSXVqeU5J7CvCCrgz
Malware Config
Extracted
vidar
26.1
276
http://centos10.com/
-
profile_id
276
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Makop family
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar family
-
CryptOne packer 1 IoCs
Detects CryptOne packer defined in NCC blogpost.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (8331) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Vidar Stealer 2 IoCs
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Executes dropped EXE 5 IoCs
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses 2FA software files, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in Program Files directory 64 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 59 IoCs
-
Suspicious use of FindShellTrayWindow 12 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\241105-dtxrgatbpg_pw_infected.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zO8010C058\전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요.exe"C:\Users\Admin\AppData\Local\Temp\7zO8010C058\전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\7zO801B1A58\전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요1.exe"C:\Users\Admin\AppData\Local\Temp\7zO801B1A58\전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요1.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zO801B1A58\전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요1.exe"C:\Users\Admin\AppData\Local\Temp\7zO801B1A58\전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요1.exe" n8443⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO801B1A58\전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요1.exe"C:\Users\Admin\AppData\Local\Temp\7zO801B1A58\전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요1.exe" n8443⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\7zO801B1A58\전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요1.exe"C:\Users\Admin\AppData\Local\Temp\7zO801B1A58\전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요1.exe" n8443⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162KB
MD540b579894b24b0337ef703a7f58939ab
SHA1c590494296b0c5683c8549ca794f063eb8ce73ec
SHA2568340faa09725265ca5efcd8946d82adef072388d3dd3806e73b7a7d97db7f3d8
SHA5129ea337d0ea74d6c4aa3927f098521339d7e6cc017a4565554b4ebbf1eed05b4d060c217d134e6894b661835c4246da421edc763919006e544ab2c8bea90e249f
-
Filesize
11.6MB
MD5236d7524027dbce337c671906c9fe10b
SHA17d345aa201b50273176ae0ec7324739d882da32e
SHA256400b64f8c61623ead9f579b99735b1b0d9febe7c829e8bdafc9b3a3269bbe21c
SHA512e5c2f87923b3331719261101b2f606298fb66442e56a49708199d8472c1ac4a72130612d3a9c344310f36fcb3cf39e4637f7dd8fb3841c61b01b95bb3794610a
-
Filesize
699KB
MD5111f15788afefb984f5b16e7b4384da7
SHA19dd9a851914ff358b392054b0b2229b2e5f042a1
SHA256705f250d5820cec1250581ef4a93462037de7a38dda8286a5c659a30822c29a5
SHA5126c9c67a1f8eb50db17a27340b836e5b5226c01414aebb41512878fef96e27113a7c837ea8b58e6c683621da9294f6a678fafb18d05094af8c8174cae4df43b64
-
Filesize
545KB
MD554bef758433c98353b61bf1e2aecefb2
SHA106feb43c6d58eab893396f63aa2e1d0e4542f7d1
SHA256291f381da3286ea93c38bb325e19f35744349c3543708135d8be731f4bafb6e2
SHA5123bfb51f9bee7033ebde0f418b88327b7c7a322b3e0572d92ad4cdf37c9fbed22d518c9ce2d8d5638381542bef83077d8054184b9f613b815df6906a99fd4526f
-
Filesize
228KB
MD58399865e44e7d6a193f8c8acf547eb31
SHA117e3bee5debada69dadec0b748256925a1a8b1ac
SHA256aaf7bb9ad358726ca367f1827686dc15fea925f26ab1e201a2768c67472e8890
SHA512bf9ceb3a36ca874dceb9ccfec8e7635f5f11f83f04226ceb4e2b4b2548dbcecf2618fe5063bec068b1571867984d0beece6b5f9be0747a13ddb53f9a09aa4d61
-
Filesize
12KB
MD5fcff5637bff8e0483f7c2a7096379144
SHA1d5ba685432c0408214ee46421d05f234b57a75a4
SHA25669e5e536923ddd59c46b7fda725dac13d474dd54772ce33a91a66d7b7043b4d0
SHA51273bc9afd50f1bc163aacf63c935a92d2270faaabd053626bd164f033bc82962a98f8c9205ae6c286a0b7960cd01002cd75a02aeae84e2b8676984e5170adc89a
-
Filesize
148KB
MD522f0e6175c91ba035ec01279cec009b4
SHA1aae7b15cb148bf5d980aedc995f7e517fd1b00af
SHA256adbc9105a687e48848ec0fd78a94821d72e7eaab5c69cd4efbd64fe219847359
SHA512096b280ff0a353a5552bb3f8aee4a7a7df7504ce6accf56c33aa36efaec50acc4047aa3a6d3f12a1fc737b7670ad501e7b6eeea5b7952dfeaab36a7255780559
-
Filesize
183KB
MD51ac58baed15231e21795ee163d3dd9aa
SHA1a74b8aa9f36428b5b64407c9a91a7074fd669e67
SHA25654ee0f7a511f7f8e811c7b3fe2865dbf0e33556a8d24afb9654fb110c0609084
SHA5126793142b4eb3091212d8b2a46adaffc42456aa021804654a6e0e17c64ecc6888871ee9cf9dfe18b02bf81c4d3412c968410c20a1632f296765c992e79c7f3801
-
Filesize
134KB
MD516e994321d39fe11177cb9771bd4ab37
SHA184bd82a29c68df2485cf0267c30191b43c63f9a0
SHA25650c1c9a9d3307cf263d0155ff5cb9e59afd90d4752b576778d5b2b4c3519d486
SHA5127cbc10d055404f316dfe18cbbbeac91afffd19c328e495af798d9dc15eb52292896e521c971abd548ddf020b9b61411eecf57d2a8f0a345ce8db9eea364463b7
-
Filesize
372KB
MD5441a671535b6d6b671f11d023225bc69
SHA15b9a13781339299bd1fda1bc02b65c14d16e45e3
SHA2563ef41a24b508be29997afb669d05f65992a612a7d5a58aedd7ba62d97c601c22
SHA5129b839d0dad8232e09f37be96cbc636bfee90595bd7f17856f7dc7b8998f9de36c5850c4f97729b6478587e2d8f3ca678998e20a548386208b9f226bd75867ce0
-
Filesize
486KB
MD52bc597c89abb6d9bef2aa2cec33e7cb8
SHA10bfc3c2785a0f5366a52c7ecd043a46695f3d400
SHA256e337a5316dd46fe0939dbb60f68e5b2dbcef0223ff7df2dff3985f6258e269e0
SHA5125afc966ef68b0d4b4e7865b81fd32ab2f1a2a68a11895195f25142a29c053461152f7fc2229e3b49d633743836a62fffa4f00a17a39647b20287669d3dd0543a
-
Filesize
576KB
MD57c56edcd21ea8d02d7e42a4b90f3720a
SHA110130ba6222eb8ffb8e8cea2453f2b003a707f4d
SHA256c0655f31bb933c73ffc48ac34e423531c6ac18f27518da50fb173e019bd6ea43
SHA51261c5282c41c567e6678aea0383a815ac2ca99a6ad2f61680d421d95147b01c07dcd5bbb787d78dc2b36796ae10431f5e30a45bb3854ad23fd91ae9dc63f77fee
-
Filesize
187KB
MD5417b05dac2dd218977cc3bfcf8aebbeb
SHA1db64b316be309297c4ce69adbe89eafa3faacf93
SHA256367d321b2e2b39eef7106ae3187d317bf1e6385c756d3165dd78f67e76b17593
SHA5124de56f2fbe0e658355dfe2a5c61234ec55f0426397318779cb38f0ba398cd37ae19229894b1c2308477c30e12f06fee3efa98d692cf5b6dae0c90306e3e15cca
-
Filesize
917KB
MD507684010415ae501fe13be66fabf33f2
SHA1055acd9c9bb31d8d4524513cd385f27fb4b6ed1a
SHA25649967fce3a9c778b26f365e9315808945d74ed878b448020f0b4657a8dae064b
SHA51260b9e775f4c6a7b51256cfa6f6eee80654f139501095a38e7f6027d1d4315cec04bb3762491c79d7b9da297195704d301e4d701977d51ffb3736ebbf96f3f18c
-
Filesize
920KB
MD58d2599bbc38d0b3a788b87a20a6d6de1
SHA1e30e84d8295035b43d578fed06630cad25cc8861
SHA25605522ae4f1b21f95f40fb9e92e72ca5feb980eed67e90180f1fb3c0d438fb156
SHA51246acb6a288b991afcbca966d587e10c9364f834e0b5f757a45693a6a209b7c40df892763197baa0c5cf3468f550b223b5442610dafc35ff003674dae00bdf35f
-
Filesize
505KB
MD54389805d7db255e55c1237dc660f8a03
SHA1e82cf47e9c8cff89c2fbe2c3c872cefced4a3fff
SHA2566df805626043193068cd9a19c4f70244a681a76f747133e8715db04e04286027
SHA51239a9390f9ecb4a95226dd601e02e9eb799f3cfc549e57b42647f77a110fdc05fa25d23e4d9c7d7ca22b50591fcf165186c8a6d862f24711100d9f65a58c188d0
-
Filesize
228KB
MD50efc4908a2d7eb68dcbde57ffb44608d
SHA10503f2e6a72ae0fff37b94c841f16ff5f13b9ae8
SHA256e6dae426b6d1df89011a3e718de2e5a93c2a3f73b4aa87b2975c20b50d378afb
SHA512e5bb8867ca1b365f0eb20258d677f556c4b04368cac2c3b9820f325c0a0e51344b069811843ea79a214ec9cb3343ba4377531d7010b6a344119604516d57a6ad
-
Filesize
81KB
MD541832f28903621b363e3db1e713a91e0
SHA1d94bc2c2e066da8a192e14e78a8d64edca7f4742
SHA25663f3c8c75835fe99ecacde0dcce49da6140f38518e1710edbfdabb81b8063a0f
SHA512e7855cc790cfa2f14d7814ff964782ff8f6e897bbf7d0413144eec55df46fd5f7c34da2b1f47834a59cdffd568ce3cb5d964ce8bdec16f858d319ae174ef4386
-
Filesize
575KB
MD567d8e7e900121df3151bb1bcb4d39d55
SHA18fc84a039188cc468b34cdd31927dc46474c7de4
SHA256ceef10ab852253fe6d404e2d59a737a33c8984acb15488dd437287550bb733fc
SHA5128b3fa6aff3b58db582e630b7540e92a1fdec19534705684b687e2a66d64599d9db47c6f45ad2fb4524564d2240fd168f570f965de545443ef5935b6be82cd983
-
Filesize
303KB
MD54f0ffc2d1b681b8cbf96b50ac64189af
SHA13ef0788ac662f7d064cf7c84be64ebff68f9e88d
SHA2566b9dfd33f4141c89a3e5724f5cfbead2ae2d3e777711d724f6865ef9631fa7f6
SHA5129779b58d20d4473a068a7507f3f0f2cae173335cb08c845d6d42aa05c45c86aa1c1b00177e2280fc402a771af1103dcbd8fc0fed87b29c5754e945e4524a95f2
-
Filesize
1KB
MD575c68ea236f8c2ce6033f41a464acb85
SHA161764ff54d6e21c8033d3713373e8ba0e269ff54
SHA25615bd310fe6a8d6c22f013f8c0e4c2e3ea816f1215441ce1a0c4747fe611f9b15
SHA512993008534835a69c200871fe57274f112bca583520233f8bdce3127fe68265834ff7914da02ac1f65ed65b3ca13dd7dd047fb04e076d878df1a19aff0a6c9119
-
Filesize
46KB
MD59cdddd22751a57ca26131f628bd73bed
SHA13f823a71a72d341568733ea180b236b56a838047
SHA25634aad39debf12cbab1a01ea1c1e85e29ec56cfe3ac1290b1e7d2bc3c4fc5f56b
SHA5128ec31d58a0a39c08ee26ad3a61bf73f2aeb48e588d6229e6c1e80f08014371c3beb26280215ac19dc1d970eb56970195a2313d049928ed53a90099886f3a566b
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB