Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 03:51
Static task
static1
Behavioral task
behavioral1
Sample
d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe
Resource
win10v2004-20240508-en
General
-
Target
d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe
-
Size
4.7MB
-
MD5
6320d63025e1764e578680e24906def3
-
SHA1
b452cb8f5fe2b5683b8ea94b90c5d3f415e53832
-
SHA256
d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0
-
SHA512
f75d2700fafea373de7f2c4131a650128d38146ef8fd7edef0c186ce3ebc1fb51b116f91596891d68f893a56b30e14035e565a55d0e5d228462c9e3e7a68dc51
-
SSDEEP
98304:KjG9asZlqf3mTJBMAxu8l+yzWCdlPtclKfWN6D:KjGgsZlqvmT8wu8lZWCzo+
Malware Config
Extracted
vidar
https://t.me/g067n
https://steamcommunity.com/profiles/76561199707802586
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0
Extracted
risepro
77.105.132.27:50500
Extracted
lumma
https://contintnetksows.shop/api
https://potterryisiw.shop/api
https://foodypannyjsud.shop/api
https://reinforcedirectorywd.shop/api
Signatures
-
Detect Vidar Stealer 5 IoCs
Processes:
resource yara_rule behavioral1/memory/4232-68-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral1/memory/4232-70-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral1/memory/4232-73-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral1/memory/4232-85-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral1/memory/4232-172-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
AFBKKFBAEG.exeIIJEBFCFIJ.exeIIEBKJECFC.exepid process 3896 AFBKKFBAEG.exe 4108 IIJEBFCFIJ.exe 396 IIEBKJECFC.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exeAFBKKFBAEG.exeIIEBKJECFC.exeIIJEBFCFIJ.exedescription pid process target process PID 2908 set thread context of 4232 2908 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 3896 set thread context of 2576 3896 AFBKKFBAEG.exe RegAsm.exe PID 396 set thread context of 2284 396 IIEBKJECFC.exe RegAsm.exe PID 4108 set thread context of 4924 4108 IIJEBFCFIJ.exe RegAsm.exe -
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3636 3896 WerFault.exe AFBKKFBAEG.exe 1280 396 WerFault.exe IIEBKJECFC.exe 2380 4108 WerFault.exe IIJEBFCFIJ.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MSBuild.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSBuild.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4780 timeout.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
MSBuild.exepid process 4232 MSBuild.exe 4232 MSBuild.exe 4232 MSBuild.exe 4232 MSBuild.exe 4232 MSBuild.exe 4232 MSBuild.exe 4232 MSBuild.exe 4232 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 2908 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe Token: SeDebugPrivilege 2284 RegAsm.exe Token: SeBackupPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeBackupPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeBackupPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeBackupPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeBackupPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeBackupPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe Token: SeSecurityPrivilege 2284 RegAsm.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exeMSBuild.exeAFBKKFBAEG.exeIIEBKJECFC.execmd.exeIIJEBFCFIJ.exedescription pid process target process PID 2908 wrote to memory of 4232 2908 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 2908 wrote to memory of 4232 2908 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 2908 wrote to memory of 4232 2908 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 2908 wrote to memory of 4232 2908 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 2908 wrote to memory of 4232 2908 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 2908 wrote to memory of 4232 2908 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 2908 wrote to memory of 4232 2908 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 2908 wrote to memory of 4232 2908 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 2908 wrote to memory of 4232 2908 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 4232 wrote to memory of 3896 4232 MSBuild.exe AFBKKFBAEG.exe PID 4232 wrote to memory of 3896 4232 MSBuild.exe AFBKKFBAEG.exe PID 4232 wrote to memory of 3896 4232 MSBuild.exe AFBKKFBAEG.exe PID 3896 wrote to memory of 2576 3896 AFBKKFBAEG.exe RegAsm.exe PID 3896 wrote to memory of 2576 3896 AFBKKFBAEG.exe RegAsm.exe PID 3896 wrote to memory of 2576 3896 AFBKKFBAEG.exe RegAsm.exe PID 3896 wrote to memory of 2576 3896 AFBKKFBAEG.exe RegAsm.exe PID 3896 wrote to memory of 2576 3896 AFBKKFBAEG.exe RegAsm.exe PID 3896 wrote to memory of 2576 3896 AFBKKFBAEG.exe RegAsm.exe PID 3896 wrote to memory of 2576 3896 AFBKKFBAEG.exe RegAsm.exe PID 3896 wrote to memory of 2576 3896 AFBKKFBAEG.exe RegAsm.exe PID 3896 wrote to memory of 2576 3896 AFBKKFBAEG.exe RegAsm.exe PID 3896 wrote to memory of 2576 3896 AFBKKFBAEG.exe RegAsm.exe PID 4232 wrote to memory of 4108 4232 MSBuild.exe IIJEBFCFIJ.exe PID 4232 wrote to memory of 4108 4232 MSBuild.exe IIJEBFCFIJ.exe PID 4232 wrote to memory of 4108 4232 MSBuild.exe IIJEBFCFIJ.exe PID 4232 wrote to memory of 396 4232 MSBuild.exe IIEBKJECFC.exe PID 4232 wrote to memory of 396 4232 MSBuild.exe IIEBKJECFC.exe PID 4232 wrote to memory of 396 4232 MSBuild.exe IIEBKJECFC.exe PID 396 wrote to memory of 2284 396 IIEBKJECFC.exe RegAsm.exe PID 396 wrote to memory of 2284 396 IIEBKJECFC.exe RegAsm.exe PID 396 wrote to memory of 2284 396 IIEBKJECFC.exe RegAsm.exe PID 396 wrote to memory of 2284 396 IIEBKJECFC.exe RegAsm.exe PID 396 wrote to memory of 2284 396 IIEBKJECFC.exe RegAsm.exe PID 396 wrote to memory of 2284 396 IIEBKJECFC.exe RegAsm.exe PID 396 wrote to memory of 2284 396 IIEBKJECFC.exe RegAsm.exe PID 396 wrote to memory of 2284 396 IIEBKJECFC.exe RegAsm.exe PID 4232 wrote to memory of 4424 4232 MSBuild.exe cmd.exe PID 4232 wrote to memory of 4424 4232 MSBuild.exe cmd.exe PID 4232 wrote to memory of 4424 4232 MSBuild.exe cmd.exe PID 4424 wrote to memory of 4780 4424 cmd.exe timeout.exe PID 4424 wrote to memory of 4780 4424 cmd.exe timeout.exe PID 4424 wrote to memory of 4780 4424 cmd.exe timeout.exe PID 4108 wrote to memory of 4924 4108 IIJEBFCFIJ.exe RegAsm.exe PID 4108 wrote to memory of 4924 4108 IIJEBFCFIJ.exe RegAsm.exe PID 4108 wrote to memory of 4924 4108 IIJEBFCFIJ.exe RegAsm.exe PID 4108 wrote to memory of 4924 4108 IIJEBFCFIJ.exe RegAsm.exe PID 4108 wrote to memory of 4924 4108 IIJEBFCFIJ.exe RegAsm.exe PID 4108 wrote to memory of 4924 4108 IIJEBFCFIJ.exe RegAsm.exe PID 4108 wrote to memory of 4924 4108 IIJEBFCFIJ.exe RegAsm.exe PID 4108 wrote to memory of 4924 4108 IIJEBFCFIJ.exe RegAsm.exe PID 4108 wrote to memory of 4924 4108 IIJEBFCFIJ.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe"C:\Users\Admin\AppData\Local\Temp\d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\AFBKKFBAEG.exe"C:\ProgramData\AFBKKFBAEG.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 3004⤵
- Program crash
-
C:\ProgramData\IIJEBFCFIJ.exe"C:\ProgramData\IIJEBFCFIJ.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 3084⤵
- Program crash
-
C:\ProgramData\IIEBKJECFC.exe"C:\ProgramData\IIEBKJECFC.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 3004⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DBFIDGIIIJDB" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3896 -ip 38961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 396 -ip 3961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4108 -ip 41081⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\AFBKKFBAEG.exeFilesize
1.8MB
MD5785a4d0ce6dee4c3bccd020a9d1b5ed9
SHA19d610511936fd60e388f344729c06a2db7479ade
SHA256f5093c69b58ce1149d43a7ec268eba733115429e26ca23820571306571b31ead
SHA5121fe0c987530a8183a0789f799bd949b1f8b2fb25bfc6110521dac5b68306f8e9c8028a952c9430b96a082c701760eade51a3112d9b8b04bf77f4c356d19d0f51
-
C:\ProgramData\IIEBKJECFC.exeFilesize
643KB
MD5f03f43046831d8eee22e959770aaedf1
SHA13e63791066428f782286f4180f82631240326344
SHA25604dbcbb46b56d4bff31ca8b58d398a90bca5f523a3ba6b8c7300e4ee19c54124
SHA512128e942b7a1778385866e8ab336ef778d7e6248b037345c0d36dd8e8329ea7952956dc7ed30ee4af58fe22a319f26c28f7062916a07a4dcd3930d854cfc6f57e
-
C:\ProgramData\IIJEBFCFIJ.exeFilesize
520KB
MD53900de86228c8f839d6d4b483794457b
SHA190e24676fd3ebcda8635704e762e83d3fbd9cfba
SHA25600c4e525ffb64ff858bb8922e3ab46ee6d65c67a3fa7d9f3a614aaf1604f27e3
SHA5125bd0c7f623a6a3c11091391c72868c4462525618164d40a28a19dc5913766b7ebb2878206b4077a7374de23562343748e27e4594ad5c56434fb9fff40e91f4dc
-
memory/2284-173-0x0000000008150000-0x0000000008768000-memory.dmpFilesize
6.1MB
-
memory/2284-175-0x0000000007CE0000-0x0000000007CF2000-memory.dmpFilesize
72KB
-
memory/2284-174-0x0000000007D90000-0x0000000007E9A000-memory.dmpFilesize
1.0MB
-
memory/2284-176-0x0000000007D40000-0x0000000007D7C000-memory.dmpFilesize
240KB
-
memory/2284-169-0x0000000004EF0000-0x0000000004EFA000-memory.dmpFilesize
40KB
-
memory/2284-168-0x0000000004F10000-0x0000000004FA2000-memory.dmpFilesize
584KB
-
memory/2284-167-0x0000000005420000-0x00000000059C4000-memory.dmpFilesize
5.6MB
-
memory/2284-166-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2284-177-0x0000000007EA0000-0x0000000007EEC000-memory.dmpFilesize
304KB
-
memory/2576-178-0x0000000000400000-0x0000000000596000-memory.dmpFilesize
1.6MB
-
memory/2576-146-0x0000000000400000-0x0000000000596000-memory.dmpFilesize
1.6MB
-
memory/2908-10-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-28-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-7-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-66-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-64-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-1-0x0000000000BD0000-0x000000000108C000-memory.dmpFilesize
4.7MB
-
memory/2908-2-0x0000000005AE0000-0x0000000005B7C000-memory.dmpFilesize
624KB
-
memory/2908-67-0x0000000074620000-0x0000000074DD0000-memory.dmpFilesize
7.7MB
-
memory/2908-62-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-60-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-59-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-57-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-54-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-52-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-50-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-48-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-46-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-44-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-42-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-38-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-36-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-34-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-32-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-0-0x000000007462E000-0x000000007462F000-memory.dmpFilesize
4KB
-
memory/2908-24-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-22-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-20-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-72-0x0000000074620000-0x0000000074DD0000-memory.dmpFilesize
7.7MB
-
memory/2908-3-0x00000000059D0000-0x00000000059DA000-memory.dmpFilesize
40KB
-
memory/2908-4-0x0000000074620000-0x0000000074DD0000-memory.dmpFilesize
7.7MB
-
memory/2908-26-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-5-0x0000000005CD0000-0x0000000005E44000-memory.dmpFilesize
1.5MB
-
memory/2908-31-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-40-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-8-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-14-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-18-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-12-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-17-0x0000000005AB0000-0x0000000005AC5000-memory.dmpFilesize
84KB
-
memory/2908-6-0x0000000005AB0000-0x0000000005ACC000-memory.dmpFilesize
112KB
-
memory/3896-142-0x0000000000A00000-0x0000000000A01000-memory.dmpFilesize
4KB
-
memory/4232-172-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/4232-85-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/4232-73-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/4232-70-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/4232-68-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB