Windows
Analysis Report
Wi50Ux1Ats.exe
Overview
General Information
Detection
Vidar
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Antivirus / Scanner detection for submitted sample
Yara detected Vidar stealer
Detected unpacking (creates a PE file in dynamic memory)
Snort IDS alert for network traffic
Found evasive API chain (may stop execution after checking mutex)
Tries to steal Crypto Currency Wallets
PE file has a writeable .text section
Machine Learning detection for sample
Self deletion via cmd delete
PE file has nameless sections
Contains functionality to detect sleep reduction / modifications
Tries to harvest and steal browser information (history, passwords, etc)
Found evasive API chain (may stop execution after checking computer name)
Uses 32bit PE files
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Is looking for software installed on the system
Queries information about the installed CPU (vendor, model number etc)
Extensive use of GetProcAddress (often used to hide API calls)
Contains functionality to read the PEB
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Uses Microsoft's Enhanced Cryptographic Provider
May check if the current machine is a sandbox (GetTickCount - Sleep)
Creates a process in suspended mode (likely to inject code)
Classification
- System is w10x64
Wi50Ux1Ats.exe (PID: 5864 cmdline:
"C:\Users\ user\Deskt op\Wi50Ux1 Ats.exe" MD5: D51C6DFF0390D4BC5863D39780F9B976) cmd.exe (PID: 1328 cmdline:
"C:\Window s\System32 \cmd.exe" /c timeout /t 5 & de l /f /q "C :\Users\us er\Desktop \Wi50Ux1At s.exe" & e xit MD5: F3BDBE3BB6F734E357235F4D5898582D) conhost.exe (PID: 1344 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) timeout.exe (PID: 3804 cmdline:
timeout /t 5 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)
- cleanup
⊘No configs have been found
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security |
⊘No Sigma rule has matched
Timestamp: | 05/03/22-12:17:08.113333 05/03/22-12:17:08.113333 |
SID: | 2035884 |
Source Port: | 80 |
Destination Port: | 49736 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: |
Source: | Avira: |
Source: | Joe Sandbox ML: |
Source: | Code function: | 0_2_00408E30 | |
Source: | Code function: | 0_2_00405450 | |
Source: | Code function: | 0_2_004090C0 | |
Source: | Code function: | 0_2_00408AB0 | |
Source: | Code function: | 0_2_00408D90 |
Compliance |
---|
Source: | Unpacked PE file: |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Code function: | 0_2_00407620 | |
Source: | Code function: | 0_2_00401280 | |
Source: | Code function: | 0_2_00401090 | |
Source: | Code function: | 0_2_0040A150 | |
Source: | Code function: | 0_2_0040B570 | |
Source: | Code function: | 0_2_0040B110 | |
Source: | Code function: | 0_2_0040B3A0 |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Networking |
---|
Source: | Snort IDS: |
Source: | ASN Name: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | HTTP traffic detected: |