vidar | 06c470803b445fa48419f5840100b63e2248b72e64c6c0ef47c44c07ff36d2a9

General

Target

34312d5802b854fa88dc661a8aa29c27.exe
Size

690KB
MD5

34312d5802b854fa88dc661a8aa29c27
SHA1

56aee5314c2e0c1077373fe02b8e59fb8882e6ff
SHA256

06c470803b445fa48419f5840100b63e2248b72e64c6c0ef47c44c07ff36d2a9
SHA512

208ab88d7ce7b789a5fc484c2a8fc643eb6481ae90394e92fbd0946ea84e10c53a01a06a13644188a3b99df6faeb35a7e7b5244e42183d60f49d09f5a97c407a

Score

10^/10

vidar discovery stealer

Malware Config

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Executes dropped EXE 1 IoCs

Processes:

wotsuper.exe

pid process

2012 wotsuper.exe
Loads dropped DLL 2 IoCs

Processes:

34312d5802b854fa88dc661a8aa29c27.exe

pid process

1704 34312d5802b854fa88dc661a8aa29c27.exe
1704 34312d5802b854fa88dc661a8aa29c27.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
2012	wotsuper.exe

pid	process
1704	34312d5802b854fa88dc661a8aa29c27.exe
1704	34312d5802b854fa88dc661a8aa29c27.exe

Drops file in Program Files directory 3 IoCs

Processes:

34312d5802b854fa88dc661a8aa29c27.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe	34312d5802b854fa88dc661a8aa29c27.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.exe	34312d5802b854fa88dc661a8aa29c27.exe
File created	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.ini	34312d5802b854fa88dc661a8aa29c27.exe

Drops file in Windows directory 1 IoCs

Processes:

34312d5802b854fa88dc661a8aa29c27.exe

description ioc process

File opened for modification C:\Windows\wotsuper.reg 34312d5802b854fa88dc661a8aa29c27.exe

description	ioc	process
File opened for modification	C:\Windows\wotsuper.reg	34312d5802b854fa88dc661a8aa29c27.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a600000000002000000000010660000000100002000000009715f84f7da5cf4f087acf81d14ba770437299171734f145e177bc6e685d221000000000e80000000020000200000005e0e5fc8c0fa9ea681d7b2e66447c37110c194affb306d1fbfad3c54e9c91e0920000000bae731d97ddff6ae6d8f60b8dcfa1f2ad67fc04e139845a5fda62f954a904ea340000000c5d7e1dbc9d5cae58e630a9962a31f6e5e79f23d095f37f89a7d76692e5ed7313fbda81295471898bd5f7ef017fcb99234398b8004dd9e2dbbb41b088c14699b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f023c0b3e8b6d601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "311726300"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000593d789df5fe737b6349c336a20884106c5e97e1105ca40504e150633afa6272000000000e8000000002000020000000e128f2966c1f34477d616af5c607a092d7796b84545fcdde8ababa7ee3c430bd900000003f34c7accf7ccc5536baadcf8e108caaf8aff2f174f8715aa5412a9c2926b79aea3f19ff831bd25860b40482b83eb6a8145090c4f8b5625bae1c2273c9a446ba8a2a9eae2f520f518a67a4614c2b14cae14a18b29a571616321e7731858ce8c4547c352da32de401b86b72ec7106964538e053c2413b3dd74ee445ab34db168783cfb352b1b2af0ab8b1d7dce60a1b5d4000000017096477ded0e46c7d30e764af387bfe9f1b0cfb18740a6cbc680205d4e65e425fc51a80bc6e5102ec858cdd898690b722784f62eecbbb68fda29d80cce950f2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB3E0A71-22DB-11EB-8030-C611B4A1F110} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

1496 regedit.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

wotsuper.exe

pid process

2012 wotsuper.exe
2012 wotsuper.exe
2012 wotsuper.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2040 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2040 iexplore.exe
2040 iexplore.exe
1248 IEXPLORE.EXE
1248 IEXPLORE.EXE
1248 IEXPLORE.EXE
1248 IEXPLORE.EXE

pid	process
1496	regedit.exe

pid	process
2012	wotsuper.exe
2012	wotsuper.exe
2012	wotsuper.exe

pid	process
2040	iexplore.exe

pid	process
2040	iexplore.exe
2040	iexplore.exe
1248	IEXPLORE.EXE
1248	IEXPLORE.EXE
1248	IEXPLORE.EXE
1248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

34312d5802b854fa88dc661a8aa29c27.exeiexplore.exe

description	pid	process	target process
PID 1704 wrote to memory of 2012	1704	34312d5802b854fa88dc661a8aa29c27.exe	wotsuper.exe
PID 1704 wrote to memory of 2012	1704	34312d5802b854fa88dc661a8aa29c27.exe	wotsuper.exe
PID 1704 wrote to memory of 2012	1704	34312d5802b854fa88dc661a8aa29c27.exe	wotsuper.exe
PID 1704 wrote to memory of 2012	1704	34312d5802b854fa88dc661a8aa29c27.exe	wotsuper.exe
PID 1704 wrote to memory of 1496	1704	34312d5802b854fa88dc661a8aa29c27.exe	regedit.exe
PID 1704 wrote to memory of 1496	1704	34312d5802b854fa88dc661a8aa29c27.exe	regedit.exe
PID 1704 wrote to memory of 1496	1704	34312d5802b854fa88dc661a8aa29c27.exe	regedit.exe
PID 1704 wrote to memory of 1496	1704	34312d5802b854fa88dc661a8aa29c27.exe	regedit.exe
PID 1704 wrote to memory of 2040	1704	34312d5802b854fa88dc661a8aa29c27.exe	iexplore.exe
PID 1704 wrote to memory of 2040	1704	34312d5802b854fa88dc661a8aa29c27.exe	iexplore.exe
PID 1704 wrote to memory of 2040	1704	34312d5802b854fa88dc661a8aa29c27.exe	iexplore.exe
PID 1704 wrote to memory of 2040	1704	34312d5802b854fa88dc661a8aa29c27.exe	iexplore.exe
PID 2040 wrote to memory of 1248	2040	iexplore.exe	IEXPLORE.EXE
PID 2040 wrote to memory of 1248	2040	iexplore.exe	IEXPLORE.EXE
PID 2040 wrote to memory of 1248	2040	iexplore.exe	IEXPLORE.EXE
PID 2040 wrote to memory of 1248	2040	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\34312d5802b854fa88dc661a8aa29c27.exe
"C:\Users\Admin\AppData\Local\Temp\34312d5802b854fa88dc661a8aa29c27.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1704

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2012

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg
2⤵
- Runs .reg file with regedit
PID:1496

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1lBhp.html
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
69e5ed9aec279294e34997335ee6f993

SHA1
e898b197130899b18ef1bc27850a07f06f049ed2

SHA256
9236112b57ba34cec82e251450eab5e12e6f15796b3fb98f8dc77c4937cf1c2a

SHA512
f8a9593fd3d4be8cdfc7c39277056625821118bc9d83a4fe59f48883f6d6ac2a82257c5443a0b94ec924faa5c2a5dcd2a0a91596de3e3a6c6157f024e1918735

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
140bf2f6e09b7463d9e94b1bc6f20e91

SHA1
02c616874475cb82e17d275db14811922880c67a

SHA256
cf8da18653947af067adeafe93bd2a658aeb51a2c5b1baf2016c4810aeecd2a1

SHA512
b211b4fe83b779bdd1e7668a7efe6d39e54739a173e6e1f95c8c5b37169ce412eaafabf7bf22dc1259e146f9bc9c00122b318489db0f76679b3dcd7eef2f53d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w5ukms8\imagestore.dat
MD5
fabc31135334e2efef63a74af145c127

SHA1
f3728ed68abd618b0bd1688e6feefd2b4e7de4d0

SHA256
73bd5852924a2171e0ef61532a8080568842655e3fd1df114ffe0d5823918eb7

SHA512
b271a0199b8851956324df730660b86f86472d467036c601d71c9152b3b6bac4b526ec93d58b24b2d91a623734bbf98f31032ad040a2dc64d693d853ee3430c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FPMUGBD4.txt
MD5
90c96cc4a7bfa1d31ca554c4fa87fea5

SHA1
2c983a3936299015e7ed57884d9cecc817085210

SHA256
bfdefd285df8cbea0184122a3b96f8d5d6359256240143bcb6d8fb6539695a8c

SHA512
c021240c2a819e5ead30112b2b126a3c87781a80177c377a997f669b43de7b9ecf3a9487dc35120cd101a646cb16e5663cfc6ebfbb05ae1116d4f41cd0499b96

Download Submit
\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
69e5ed9aec279294e34997335ee6f993

SHA1
e898b197130899b18ef1bc27850a07f06f049ed2

SHA256
9236112b57ba34cec82e251450eab5e12e6f15796b3fb98f8dc77c4937cf1c2a

SHA512
f8a9593fd3d4be8cdfc7c39277056625821118bc9d83a4fe59f48883f6d6ac2a82257c5443a0b94ec924faa5c2a5dcd2a0a91596de3e3a6c6157f024e1918735

Download Submit
\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
69e5ed9aec279294e34997335ee6f993

SHA1
e898b197130899b18ef1bc27850a07f06f049ed2

SHA256
9236112b57ba34cec82e251450eab5e12e6f15796b3fb98f8dc77c4937cf1c2a

SHA512
f8a9593fd3d4be8cdfc7c39277056625821118bc9d83a4fe59f48883f6d6ac2a82257c5443a0b94ec924faa5c2a5dcd2a0a91596de3e3a6c6157f024e1918735

Download Submit
memory/1248-9-0x0000000000000000-mapping.dmp

Download
memory/1496-4-0x0000000000000000-mapping.dmp

Download
memory/1776-6-0x000007FEF69C0000-0x000007FEF6C3A000-memory.dmp

Filesize
2.5MB

Download
memory/2012-8-0x0000000001F10000-0x0000000001F21000-memory.dmp

Filesize
68KB

Download
memory/2012-7-0x00000000005CB000-0x00000000005CC000-memory.dmp

Filesize
4KB

Download
memory/2012-2-0x0000000000000000-mapping.dmp

Download
memory/2040-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads