Analysis
-
max time kernel
142s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 13:39
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240611-en
General
-
Target
Setup.exe
-
Size
40.0MB
-
MD5
36408e074e73dd9c328bfbddebe68c3e
-
SHA1
883d5d71e3adba2962eb84f42b5687dde8f1a442
-
SHA256
8c984d1cd3cdcfa53d735568c02ec35e0b7104da679442c275329e0748423d38
-
SHA512
99bec46233b4361b22e3b51a999b00c03052b6ddd7c035b80a65f5c08a3b81473c68be8d39a0415d2ea8966565e94a35b623e3ab8dc6a1ea6abc5c17e4910333
-
SSDEEP
98304:F9sgNLBXKolKOUnOqoDJA669v/XH5bPGroIk:F6gdTMrKJAJlJzD
Malware Config
Extracted
vidar
https://t.me/g067n
https://steamcommunity.com/profiles/76561199707802586
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0
Signatures
-
Detect Vidar Stealer 8 IoCs
Processes:
resource yara_rule behavioral2/memory/2676-25-0x0000000001600000-0x0000000001849000-memory.dmp family_vidar_v7 behavioral2/memory/2676-38-0x0000000001600000-0x0000000001849000-memory.dmp family_vidar_v7 behavioral2/memory/2676-81-0x0000000001600000-0x0000000001849000-memory.dmp family_vidar_v7 behavioral2/memory/2676-82-0x0000000001600000-0x0000000001849000-memory.dmp family_vidar_v7 behavioral2/memory/2676-85-0x0000000001600000-0x0000000001849000-memory.dmp family_vidar_v7 behavioral2/memory/2676-89-0x0000000001600000-0x0000000001849000-memory.dmp family_vidar_v7 behavioral2/memory/2676-90-0x0000000001600000-0x0000000001849000-memory.dmp family_vidar_v7 behavioral2/memory/2676-92-0x0000000001600000-0x0000000001849000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
VIDA.au3description ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation VIDA.au3 -
Loads dropped DLL 1 IoCs
Processes:
VIDA.au3pid process 2676 VIDA.au3 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid process target process PID 1004 set thread context of 2332 1004 Setup.exe more.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
VIDA.au3description ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 VIDA.au3 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString VIDA.au3 -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4916 timeout.exe -
Processes:
VIDA.au3description ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4 VIDA.au3 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f VIDA.au3 -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
Setup.exemore.comVIDA.au3pid process 1004 Setup.exe 1004 Setup.exe 2332 more.com 2332 more.com 2676 VIDA.au3 2676 VIDA.au3 2676 VIDA.au3 2676 VIDA.au3 2676 VIDA.au3 2676 VIDA.au3 2676 VIDA.au3 2676 VIDA.au3 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
VIDA.au3pid process 2676 VIDA.au3 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Setup.exemore.compid process 1004 Setup.exe 2332 more.com -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
VIDA.au3pid process 2676 VIDA.au3 2676 VIDA.au3 -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Setup.exemore.comVIDA.au3cmd.exedescription pid process target process PID 1004 wrote to memory of 2332 1004 Setup.exe more.com PID 1004 wrote to memory of 2332 1004 Setup.exe more.com PID 1004 wrote to memory of 2332 1004 Setup.exe more.com PID 1004 wrote to memory of 2332 1004 Setup.exe more.com PID 2332 wrote to memory of 2676 2332 more.com VIDA.au3 PID 2332 wrote to memory of 2676 2332 more.com VIDA.au3 PID 2332 wrote to memory of 2676 2332 more.com VIDA.au3 PID 2332 wrote to memory of 2676 2332 more.com VIDA.au3 PID 2332 wrote to memory of 2676 2332 more.com VIDA.au3 PID 2332 wrote to memory of 2676 2332 more.com VIDA.au3 PID 2676 wrote to memory of 3940 2676 VIDA.au3 cmd.exe PID 2676 wrote to memory of 3940 2676 VIDA.au3 cmd.exe PID 2676 wrote to memory of 3940 2676 VIDA.au3 cmd.exe PID 3940 wrote to memory of 4916 3940 cmd.exe timeout.exe PID 3940 wrote to memory of 4916 3940 cmd.exe timeout.exe PID 3940 wrote to memory of 4916 3940 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\more.comC:\Windows\SysWOW64\more.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VIDA.au3C:\Users\Admin\AppData\Local\Temp\VIDA.au33⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FHJKKECFIECA" & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 105⤵
- Delays execution with timeout.exe
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\VIDA.au3Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\c7c12140Filesize
1.7MB
MD5a26a5154155daf58c548cc8c265989e8
SHA19e50d00fa14a124fc8d3738a30f97855d9b19233
SHA256c7653f14cfc64b28e9ecb54e3b29d921dee05d0ff22d148f36e8a8ab15535698
SHA512054bb206d31b7a4884598d1cfc46a45e26747a42e69e693fd87b83f4fa0f892660955517855abcbdfefc1362dcdd911463d71f106d991d577733072af0fb4ca1
-
C:\Users\Admin\AppData\Local\Temp\cb4ddee8Filesize
1.7MB
MD5aa076babcf601ba0061df4c78311680d
SHA1d53caf458d2e6bfc4ddb5b34cbf9b5d12c2c163b
SHA256743e071ef8c1bd5488dc02fc5fbf115ff0c80d60da3c326871c121659b5d3431
SHA5120d8eb47b3fff33cc863594090395bad4a93f20360a50c0f066f1b9dcf2ed9a3a3db628af83353debe9ce73dba04b1d16547fefe4a727dd103abbdc983fa70469
-
memory/1004-0-0x00000000005E0000-0x0000000000ACB000-memory.dmpFilesize
4.9MB
-
memory/1004-6-0x0000000074650000-0x00000000747CB000-memory.dmpFilesize
1.5MB
-
memory/1004-7-0x00007FFF95B50000-0x00007FFF95D45000-memory.dmpFilesize
2.0MB
-
memory/1004-9-0x0000000074650000-0x00000000747CB000-memory.dmpFilesize
1.5MB
-
memory/1004-8-0x0000000074662000-0x0000000074664000-memory.dmpFilesize
8KB
-
memory/1004-10-0x0000000074650000-0x00000000747CB000-memory.dmpFilesize
1.5MB
-
memory/2332-22-0x0000000074650000-0x00000000747CB000-memory.dmpFilesize
1.5MB
-
memory/2332-12-0x0000000074650000-0x00000000747CB000-memory.dmpFilesize
1.5MB
-
memory/2332-18-0x0000000074650000-0x00000000747CB000-memory.dmpFilesize
1.5MB
-
memory/2332-14-0x00007FFF95B50000-0x00007FFF95D45000-memory.dmpFilesize
2.0MB
-
memory/2332-16-0x0000000074650000-0x00000000747CB000-memory.dmpFilesize
1.5MB
-
memory/2676-38-0x0000000001600000-0x0000000001849000-memory.dmpFilesize
2.3MB
-
memory/2676-26-0x00007FFF95B50000-0x00007FFF95D45000-memory.dmpFilesize
2.0MB
-
memory/2676-25-0x0000000001600000-0x0000000001849000-memory.dmpFilesize
2.3MB
-
memory/2676-41-0x000000001B360000-0x000000001B5BF000-memory.dmpFilesize
2.4MB
-
memory/2676-81-0x0000000001600000-0x0000000001849000-memory.dmpFilesize
2.3MB
-
memory/2676-82-0x0000000001600000-0x0000000001849000-memory.dmpFilesize
2.3MB
-
memory/2676-85-0x0000000001600000-0x0000000001849000-memory.dmpFilesize
2.3MB
-
memory/2676-89-0x0000000001600000-0x0000000001849000-memory.dmpFilesize
2.3MB
-
memory/2676-90-0x0000000001600000-0x0000000001849000-memory.dmpFilesize
2.3MB
-
memory/2676-92-0x0000000001600000-0x0000000001849000-memory.dmpFilesize
2.3MB