Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
29-06-2024 17:00
Static task
static1
Behavioral task
behavioral1
Sample
a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe
Resource
win10v2004-20240508-en
General
-
Target
a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe
-
Size
4.3MB
-
MD5
67cef2b94174d0883a8e8b9ad9c217c7
-
SHA1
d674a6454b03d5190ea685112e68a6604eabfc39
-
SHA256
a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7
-
SHA512
bd335514641c23f96063c92783bcc2e607c7765705aafa2e742b631c102c08704b1bc77ba61dce7f2267abd5e0e4a30653a50179f86689ecf348f5eb0057ea3c
-
SSDEEP
49152:WgMCMqzvDxEHJKquC8nlPCx0jdt8not+bgZV014po/8QNT9Fr1:wGdlbInoM0bBO5H
Malware Config
Extracted
vidar
https://t.me/g067n
https://steamcommunity.com/profiles/76561199707802586
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0
Signatures
-
Detect Vidar Stealer 6 IoCs
Processes:
resource yara_rule behavioral2/memory/1308-69-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/1308-72-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/1308-67-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/1308-74-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/1308-75-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/1308-77-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exedescription pid process target process PID 1940 set thread context of 1308 1940 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MSBuild.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSBuild.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 872 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
MSBuild.exepid process 1308 MSBuild.exe 1308 MSBuild.exe 1308 MSBuild.exe 1308 MSBuild.exe 1308 MSBuild.exe 1308 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exedescription pid process Token: SeDebugPrivilege 1940 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exeMSBuild.execmd.exedescription pid process target process PID 1940 wrote to memory of 1308 1940 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 1940 wrote to memory of 1308 1940 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 1940 wrote to memory of 1308 1940 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 1940 wrote to memory of 1308 1940 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 1940 wrote to memory of 1308 1940 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 1940 wrote to memory of 1308 1940 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 1940 wrote to memory of 1308 1940 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 1940 wrote to memory of 1308 1940 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 1940 wrote to memory of 1308 1940 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 1308 wrote to memory of 5092 1308 MSBuild.exe cmd.exe PID 1308 wrote to memory of 5092 1308 MSBuild.exe cmd.exe PID 1308 wrote to memory of 5092 1308 MSBuild.exe cmd.exe PID 5092 wrote to memory of 872 5092 cmd.exe timeout.exe PID 5092 wrote to memory of 872 5092 cmd.exe timeout.exe PID 5092 wrote to memory of 872 5092 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe"C:\Users\Admin\AppData\Local\Temp\a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\GDGHJEHJJDAA" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1308-69-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/1308-77-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/1308-75-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/1308-74-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/1308-67-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/1308-72-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/1940-44-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-38-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-54-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-66-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-63-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-6-0x00000000059C0000-0x00000000059DC000-memory.dmpFilesize
112KB
-
memory/1940-71-0x0000000074620000-0x0000000074DD1000-memory.dmpFilesize
7.7MB
-
memory/1940-5-0x0000000005C20000-0x0000000005D2C000-memory.dmpFilesize
1.0MB
-
memory/1940-4-0x0000000074620000-0x0000000074DD1000-memory.dmpFilesize
7.7MB
-
memory/1940-60-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-58-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-56-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-53-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-50-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-48-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-46-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-0-0x000000007462E000-0x000000007462F000-memory.dmpFilesize
4KB
-
memory/1940-42-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-40-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-22-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-36-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-34-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-32-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-30-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-28-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-26-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-24-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-21-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-18-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-16-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-14-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-12-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-10-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-64-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-8-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-7-0x00000000059C0000-0x00000000059D5000-memory.dmpFilesize
84KB
-
memory/1940-73-0x0000000074620000-0x0000000074DD1000-memory.dmpFilesize
7.7MB
-
memory/1940-3-0x0000000005910000-0x000000000591A000-memory.dmpFilesize
40KB
-
memory/1940-2-0x0000000005A00000-0x0000000005A9C000-memory.dmpFilesize
624KB
-
memory/1940-1-0x0000000000AA0000-0x0000000000EF2000-memory.dmpFilesize
4.3MB