Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 13:39
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240611-en
General
-
Target
Setup.exe
-
Size
40.0MB
-
MD5
36408e074e73dd9c328bfbddebe68c3e
-
SHA1
883d5d71e3adba2962eb84f42b5687dde8f1a442
-
SHA256
8c984d1cd3cdcfa53d735568c02ec35e0b7104da679442c275329e0748423d38
-
SHA512
99bec46233b4361b22e3b51a999b00c03052b6ddd7c035b80a65f5c08a3b81473c68be8d39a0415d2ea8966565e94a35b623e3ab8dc6a1ea6abc5c17e4910333
-
SSDEEP
98304:F9sgNLBXKolKOUnOqoDJA669v/XH5bPGroIk:F6gdTMrKJAJlJzD
Malware Config
Extracted
vidar
https://t.me/g067n
https://steamcommunity.com/profiles/76561199707802586
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0
Signatures
-
Detect Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2488-26-0x0000000000740000-0x0000000000989000-memory.dmp family_vidar_v7 behavioral1/memory/2488-33-0x0000000000740000-0x0000000000989000-memory.dmp family_vidar_v7 -
Loads dropped DLL 7 IoCs
Processes:
more.comVIDA.au3WerFault.exepid process 2836 more.com 2488 VIDA.au3 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid process target process PID 2352 set thread context of 2836 2352 Setup.exe more.com -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2936 2488 WerFault.exe VIDA.au3 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Setup.exemore.compid process 2352 Setup.exe 2352 Setup.exe 2836 more.com 2836 more.com -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Setup.exemore.compid process 2352 Setup.exe 2836 more.com -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Setup.exemore.comVIDA.au3description pid process target process PID 2352 wrote to memory of 2836 2352 Setup.exe more.com PID 2352 wrote to memory of 2836 2352 Setup.exe more.com PID 2352 wrote to memory of 2836 2352 Setup.exe more.com PID 2352 wrote to memory of 2836 2352 Setup.exe more.com PID 2352 wrote to memory of 2836 2352 Setup.exe more.com PID 2836 wrote to memory of 2488 2836 more.com VIDA.au3 PID 2836 wrote to memory of 2488 2836 more.com VIDA.au3 PID 2836 wrote to memory of 2488 2836 more.com VIDA.au3 PID 2836 wrote to memory of 2488 2836 more.com VIDA.au3 PID 2836 wrote to memory of 2488 2836 more.com VIDA.au3 PID 2836 wrote to memory of 2488 2836 more.com VIDA.au3 PID 2488 wrote to memory of 2936 2488 VIDA.au3 WerFault.exe PID 2488 wrote to memory of 2936 2488 VIDA.au3 WerFault.exe PID 2488 wrote to memory of 2936 2488 VIDA.au3 WerFault.exe PID 2488 wrote to memory of 2936 2488 VIDA.au3 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\more.comC:\Windows\SysWOW64\more.com2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VIDA.au3C:\Users\Admin\AppData\Local\Temp\VIDA.au33⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 1484⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\b6b56198Filesize
1.7MB
MD5a26a5154155daf58c548cc8c265989e8
SHA19e50d00fa14a124fc8d3738a30f97855d9b19233
SHA256c7653f14cfc64b28e9ecb54e3b29d921dee05d0ff22d148f36e8a8ab15535698
SHA512054bb206d31b7a4884598d1cfc46a45e26747a42e69e693fd87b83f4fa0f892660955517855abcbdfefc1362dcdd911463d71f106d991d577733072af0fb4ca1
-
C:\Users\Admin\AppData\Local\Temp\ba79f85cFilesize
1.7MB
MD5dcbdf7f7299702e23c54fbc985d5e291
SHA1906f8b3d39b7f0c4939c56a0d6fc8efe645d7c3e
SHA25613c4ddcc23382f0702174335f082e7239635a38a1c59091dae02a803ad3e088c
SHA512690b4d0251a832003b86c38790e8cde9dd045d0c0610f16801e9c83e380860157b64cfc1c94d3ecb4242d1c2f8a83bb4dcaa12be73dc8443d9fe83f2fab112b2
-
\Users\Admin\AppData\Local\Temp\VIDA.au3Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
memory/2352-8-0x0000000073FF2000-0x0000000073FF4000-memory.dmpFilesize
8KB
-
memory/2352-6-0x0000000073FE0000-0x0000000074154000-memory.dmpFilesize
1.5MB
-
memory/2352-9-0x0000000073FE0000-0x0000000074154000-memory.dmpFilesize
1.5MB
-
memory/2352-10-0x0000000073FE0000-0x0000000074154000-memory.dmpFilesize
1.5MB
-
memory/2352-0-0x0000000000400000-0x00000000008EB000-memory.dmpFilesize
4.9MB
-
memory/2352-7-0x0000000076F00000-0x00000000770A9000-memory.dmpFilesize
1.7MB
-
memory/2488-23-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2488-22-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2488-26-0x0000000000740000-0x0000000000989000-memory.dmpFilesize
2.3MB
-
memory/2488-33-0x0000000000740000-0x0000000000989000-memory.dmpFilesize
2.3MB
-
memory/2836-14-0x0000000076F00000-0x00000000770A9000-memory.dmpFilesize
1.7MB
-
memory/2836-16-0x0000000073FE0000-0x0000000074154000-memory.dmpFilesize
1.5MB
-
memory/2836-20-0x0000000073FE0000-0x0000000074154000-memory.dmpFilesize
1.5MB
-
memory/2836-12-0x0000000073FE0000-0x0000000074154000-memory.dmpFilesize
1.5MB
-
memory/2836-24-0x0000000073FE0000-0x0000000074154000-memory.dmpFilesize
1.5MB