Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Overview

General Information

Sample name:a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
Analysis ID:1487424
MD5:3cd180f72198597215cab492c109f5a0
SHA1:01ceb31bfcb1f5d6eefffa5bf1c6cb891ca6dd75
SHA256:5ad0e5d670206288abccd95bb0e3ff1ee9a889b49423cb5160c7c59912991a0d
Tags:exe
Infos:

Detection

Vidar
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected Powershell download and execute
Yara detected Vidar
Yara detected Vidar stealer
.NET source code contains method to dynamically call methods (often used by packers)
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Searches for specific processes (likely to inject)
Sigma detected: Silenttrinity Stager Msbuild Activity
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe (PID: 6448 cmdline: "C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe" MD5: 3CD180F72198597215CAB492C109F5A0)
    • EHDHIDAEHC.exe (PID: 5460 cmdline: "C:\ProgramData\EHDHIDAEHC.exe" MD5: 4B005E8541F7ED9BD82D80CE58C55C7C)
      • MSBuild.exe (PID: 5040 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)
      • MSBuild.exe (PID: 1596 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)
    • cmd.exe (PID: 480 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BFCAAEHJDBKJ" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 2840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • timeout.exe (PID: 5888 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
VidarVidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199747278259"], "Botnet": "625d7a8e379321656ff1b88ebf9542b7"}

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exeJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
    a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exeJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security

      PCAP (Network Traffic)

      SourceRuleDescriptionAuthorStrings
      sslproxydump.pcapJoeSecurity_Vidar_2Yara detected VidarJoe Security

        Memory Dumps

        SourceRuleDescriptionAuthorStrings
        00000004.00000002.2094707680.000000000436C000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
          00000004.00000002.2094707680.0000000003EC0000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
            00000004.00000002.2092269679.0000000002FC9000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
              00000000.00000000.1698830320.00000000003F0000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
                00000004.00000002.2094707680.000000000439A000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
                  Click to see the 14 entries

                  Unpacked PEs

                  SourceRuleDescriptionAuthorStrings
                  0.2.a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe.3d0000.0.unpackJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
                    4.2.EHDHIDAEHC.exe.439a680.4.raw.unpackJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
                      4.2.EHDHIDAEHC.exe.436ce50.10.unpackJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
                        4.2.EHDHIDAEHC.exe.3e931c0.5.unpackJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
                          4.2.EHDHIDAEHC.exe.3ec09f0.8.unpackJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
                            Click to see the 7 entries

                            Sigma Signatures

                            System Summary

                            barindex
                            Sigma detected: Silenttrinity Stager Msbuild Activity
                            Source: Network ConnectionAuthor: Kiran kumar s, oscd.community: Data: DestinationIp: 104.102.49.249, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 1596, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49764

                            Snort Signatures

                            ⊘No Snort rule has matched

                            Suricata Signatures

                            Timestamp:2024-08-04T02:21:09.387299+0200
                            SID:2028765
                            Source Port:49735
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:40.705665+0200
                            SID:2028765
                            Source Port:49758
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:05.469356+0200
                            SID:2028765
                            Source Port:49732
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:22:00.525216+0200
                            SID:2051831
                            Source Port:443
                            Destination Port:49770
                            Protocol:TCP
                            Classtype:Malware Command and Control Activity Detected
                            Timestamp:2024-08-04T02:21:33.096263+0200
                            SID:2028765
                            Source Port:49755
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:22:01.268905+0200
                            SID:2028765
                            Source Port:49771
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:59.869588+0200
                            SID:2028765
                            Source Port:49770
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:57.263946+0200
                            SID:2028765
                            Source Port:49767
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:22:05.282515+0200
                            SID:2028765
                            Source Port:49773
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:59.217631+0200
                            SID:2044247
                            Source Port:443
                            Destination Port:49768
                            Protocol:TCP
                            Classtype:Malware Command and Control Activity Detected
                            Timestamp:2024-08-04T02:21:48.867868+0200
                            SID:2054495
                            Source Port:49763
                            Destination Port:80
                            Protocol:TCP
                            Classtype:A Network Trojan was detected
                            Timestamp:2024-08-04T02:22:02.304940+0200
                            SID:2028765
                            Source Port:49772
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:12.059992+0200
                            SID:2028765
                            Source Port:49737
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:16.647582+0200
                            SID:2028765
                            Source Port:49739
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:43.438103+0200
                            SID:2028765
                            Source Port:49760
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:08.096471+0200
                            SID:2028765
                            Source Port:49734
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:20.175940+0200
                            SID:2028765
                            Source Port:49742
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:10.041222+0200
                            SID:2049087
                            Source Port:49735
                            Destination Port:443
                            Protocol:TCP
                            Classtype:A Network Trojan was detected
                            Timestamp:2024-08-04T02:21:06.778617+0200
                            SID:2028765
                            Source Port:49733
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:24.249194+0200
                            SID:2028765
                            Source Port:49749
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:17.658852+0200
                            SID:2028765
                            Source Port:49740
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:28.937524+0200
                            SID:2028765
                            Source Port:49753
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:22:06.316077+0200
                            SID:2028765
                            Source Port:49774
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:26.017652+0200
                            SID:2028765
                            Source Port:49751
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:13.945829+0200
                            SID:2011803
                            Source Port:443
                            Destination Port:49737
                            Protocol:TCP
                            Classtype:Executable code was detected
                            Timestamp:2024-08-04T02:21:22.165718+0200
                            SID:2028765
                            Source Port:49745
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:23.019226+0200
                            SID:2011803
                            Source Port:443
                            Destination Port:49745
                            Protocol:TCP
                            Classtype:Executable code was detected
                            Timestamp:2024-08-04T02:21:15.032943+0200
                            SID:2028765
                            Source Port:49738
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:18.841343+0200
                            SID:2028765
                            Source Port:49741
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:10.921800+0200
                            SID:2028765
                            Source Port:49736
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:10.041373+0200
                            SID:2051831
                            Source Port:443
                            Destination Port:49735
                            Protocol:TCP
                            Classtype:Malware Command and Control Activity Detected
                            Timestamp:2024-08-04T02:21:45.523846+0200
                            SID:2028765
                            Source Port:49761
                            Destination Port:443
                            Protocol:TCP
                            Classtype:Unknown Traffic
                            Timestamp:2024-08-04T02:21:31.888318+0200
                            SID:2028765
                            Source Port:49754
                            Destination Port:443<