Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

02/02/2025, 05:52

250202-gk9lfszpfm 10

Analysis

  • max time kernel
    94s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/02/2025, 05:52

General

  • Target

    Luna.exe

  • Size

    3.7MB

  • MD5

    a425e9ae201f3aea1583f56c1194d0d1

  • SHA1

    e533d3fafedec17a344b1f0dca240854c9b67cbb

  • SHA256

    0db9e114fb628164f24fde65b37ab19e4db07e9a60f1a94c3111dd8e85feef94

  • SHA512

    d3b60dc84ae98c4589d31e54c2ac7de83527814cbf442d2211a6b77678d41ba05ae64b8fa39b8d525d0a5df46c510b9881ec944c92e1b82490fbb259e2303def

  • SSDEEP

    49152:+3iYNwJmVVyVfDeCO2sST0tnx8t/dSoV1Yer1nCYr093R+pQis++ELzl/KuBIYyI:+SYzV2O2sUmnoX1+Ri3s+p3y5zMPx

Score
10/10

Malware Config

Extracted

Family

vidar

C2

https://t.me/m08mbk

https://steamcommunity.com/profiles/76561199820567237

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3424
      • C:\Users\Admin\AppData\Local\Temp\Luna.exe
        "C:\Users\Admin\AppData\Local\Temp\Luna.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3388
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2744

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2744-1358-0x0000000000400000-0x000000000044B000-memory.dmp

      Filesize

      300KB

    • memory/2744-1366-0x0000000000400000-0x000000000044B000-memory.dmp

      Filesize

      300KB

    • memory/3388-0-0x00000000026B0000-0x000000000282C000-memory.dmp

      Filesize

      1.5MB

    • memory/3388-1-0x00000000026B0000-0x000000000282C000-memory.dmp

      Filesize

      1.5MB

    • memory/3388-3-0x0000000073DBE000-0x0000000073DBF000-memory.dmp

      Filesize

      4KB

    • memory/3388-4-0x0000000005610000-0x000000000578C000-memory.dmp

      Filesize

      1.5MB

    • memory/3388-5-0x0000000073DB0000-0x0000000074560000-memory.dmp

      Filesize

      7.7MB

    • memory/3388-6-0x0000000073DB0000-0x0000000074560000-memory.dmp

      Filesize

      7.7MB

    • memory/3388-7-0x0000000073DB0000-0x0000000074560000-memory.dmp

      Filesize

      7.7MB

    • memory/3388-9-0x0000000005490000-0x00000000055AE000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-8-0x0000000073DB0000-0x0000000074560000-memory.dmp

      Filesize

      7.7MB

    • memory/3388-10-0x0000000005890000-0x00000000059B0000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-11-0x00000000059B0000-0x0000000005F54000-memory.dmp

      Filesize

      5.6MB

    • memory/3388-12-0x0000000005F60000-0x0000000005FF2000-memory.dmp

      Filesize

      584KB

    • memory/3388-16-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-36-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-34-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-72-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-74-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-70-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-68-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-66-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-64-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-62-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-60-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-58-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-56-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-52-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-50-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-48-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-40-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-38-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-32-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-26-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-24-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-54-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-20-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-46-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-44-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-42-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-18-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-30-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-28-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-14-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-23-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-13-0x0000000005890000-0x00000000059AA000-memory.dmp

      Filesize

      1.1MB

    • memory/3388-1335-0x0000000073DB0000-0x0000000074560000-memory.dmp

      Filesize

      7.7MB

    • memory/3388-1336-0x00000000061E0000-0x000000000625A000-memory.dmp

      Filesize

      488KB

    • memory/3388-1337-0x00000000062C0000-0x0000000006338000-memory.dmp

      Filesize

      480KB

    • memory/3388-1338-0x0000000006340000-0x000000000638C000-memory.dmp

      Filesize

      304KB

    • memory/3388-1339-0x0000000073DBE000-0x0000000073DBF000-memory.dmp

      Filesize

      4KB

    • memory/3388-1340-0x0000000073DB0000-0x0000000074560000-memory.dmp

      Filesize

      7.7MB

    • memory/3388-1341-0x0000000073DB0000-0x0000000074560000-memory.dmp

      Filesize

      7.7MB

    • memory/3388-1342-0x0000000073DB0000-0x0000000074560000-memory.dmp

      Filesize

      7.7MB

    • memory/3388-1343-0x0000000073DB0000-0x0000000074560000-memory.dmp

      Filesize

      7.7MB

    • memory/3388-1344-0x0000000006390000-0x00000000063E4000-memory.dmp

      Filesize

      336KB

    • memory/3388-1348-0x0000000073DB0000-0x0000000074560000-memory.dmp

      Filesize

      7.7MB

    • memory/3388-1354-0x0000000073DB0000-0x0000000074560000-memory.dmp

      Filesize

      7.7MB

    • memory/3388-1351-0x0000000073DB0000-0x0000000074560000-memory.dmp

      Filesize

      7.7MB

    • memory/3388-1349-0x0000000073DB0000-0x0000000074560000-memory.dmp

      Filesize

      7.7MB

    • memory/3388-1359-0x0000000073DB0000-0x0000000074560000-memory.dmp

      Filesize

      7.7MB