vidar | fcac1c6c86cda94817da16feb772744ab591e3d1192955b32b074034ea122bf1

General

Target

464464b0f26f533bb0c6f48a744bf334.exe
Size

685KB
MD5

464464b0f26f533bb0c6f48a744bf334
SHA1

91f80b92ade33c48e74c587a2e9c51d164d81dd8
SHA256

fcac1c6c86cda94817da16feb772744ab591e3d1192955b32b074034ea122bf1
SHA512

fa96a422461391481fdf41a30175f3e2adc5add8fad5b9fc1bb4ac60250998342ad8be5b932dfb58d36c5d0a9e5c1c7537d679908b47398026e99661ede9442e

Score

10^/10

vidar discovery stealer

Malware Config

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Executes dropped EXE 1 IoCs

Processes:

wotsuper.exe

pid process

1980 wotsuper.exe
Loads dropped DLL 2 IoCs

Processes:

464464b0f26f533bb0c6f48a744bf334.exe

pid process

1900 464464b0f26f533bb0c6f48a744bf334.exe
1900 464464b0f26f533bb0c6f48a744bf334.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
1980	wotsuper.exe

pid	process
1900	464464b0f26f533bb0c6f48a744bf334.exe
1900	464464b0f26f533bb0c6f48a744bf334.exe

Drops file in Program Files directory 3 IoCs

Processes:

464464b0f26f533bb0c6f48a744bf334.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe	464464b0f26f533bb0c6f48a744bf334.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.exe	464464b0f26f533bb0c6f48a744bf334.exe
File created	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.ini	464464b0f26f533bb0c6f48a744bf334.exe

Drops file in Windows directory 1 IoCs

Processes:

464464b0f26f533bb0c6f48a744bf334.exe

description ioc process

File opened for modification C:\Windows\wotsuper.reg 464464b0f26f533bb0c6f48a744bf334.exe

description	ioc	process
File opened for modification	C:\Windows\wotsuper.reg	464464b0f26f533bb0c6f48a744bf334.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d7c095feb6d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000c9b09ce401bab344ec253e568f36e91dca895c8832aa8158ca332ab445643b96000000000e8000000002000020000000c2c071533cc0b8f680148ae653cceea2543b5d3abf7fe60d419135457de038ac90000000db3e074dc7851605e7322ad56ddd2de1cde83c07d9f53068105905468741e5f845582ac815012afe858452e66a67a31bfc3c3746293a9e55e879fc7a5f80a1effb4db3e640756b40521e7c78cfb99142a5f0606aaec810bc7a3940a5d284bfe003478ca3fcd6182a281e18c14970712325fe46921bffe802296b09b6b339475d8bc8c9791c6c9e4f26202c902413d36340000000e3c0eb7540a29d36d2840fddad27492795d1d6cecd9de795372563aa503ba1f064a64c2cd06d3e9b738308ba27159ad7740c3303599dcc07cc518db70fe0aa32	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "311735698"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000f428dc92811b146b37d7fcb6ce846e92cee0bf3450cc35a2d160b0569a684ffa000000000e80000000020000200000003143a5c1c025c72be115cae1eec9a6828ac49364db8bbd769b78351185fabf3020000000d9cd73143c6b9df73494f414beead723b7e5090ffbdecfd0a8c0e1fb97a4f350400000007cbd3fb8b36d083570a5293d2941f4b119813030e1b0126f96693b34a2c5a4ed16ef0920380ea46c04059c548ddef92b5e62711795c754901217cbb205783387	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD9605C1-22F1-11EB-9E5C-424ABE5A776C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

1180 regedit.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

wotsuper.exe

pid process

1980 wotsuper.exe
1980 wotsuper.exe
1980 wotsuper.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1776 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1776 iexplore.exe
1776 iexplore.exe
460 IEXPLORE.EXE
460 IEXPLORE.EXE

pid	process
1180	regedit.exe

pid	process
1980	wotsuper.exe
1980	wotsuper.exe
1980	wotsuper.exe

pid	process
1776	iexplore.exe

pid	process
1776	iexplore.exe
1776	iexplore.exe
460	IEXPLORE.EXE
460	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

464464b0f26f533bb0c6f48a744bf334.exeiexplore.exe

description	pid	process	target process
PID 1900 wrote to memory of 1980	1900	464464b0f26f533bb0c6f48a744bf334.exe	wotsuper.exe
PID 1900 wrote to memory of 1980	1900	464464b0f26f533bb0c6f48a744bf334.exe	wotsuper.exe
PID 1900 wrote to memory of 1980	1900	464464b0f26f533bb0c6f48a744bf334.exe	wotsuper.exe
PID 1900 wrote to memory of 1980	1900	464464b0f26f533bb0c6f48a744bf334.exe	wotsuper.exe
PID 1900 wrote to memory of 1180	1900	464464b0f26f533bb0c6f48a744bf334.exe	regedit.exe
PID 1900 wrote to memory of 1180	1900	464464b0f26f533bb0c6f48a744bf334.exe	regedit.exe
PID 1900 wrote to memory of 1180	1900	464464b0f26f533bb0c6f48a744bf334.exe	regedit.exe
PID 1900 wrote to memory of 1180	1900	464464b0f26f533bb0c6f48a744bf334.exe	regedit.exe
PID 1900 wrote to memory of 1776	1900	464464b0f26f533bb0c6f48a744bf334.exe	iexplore.exe
PID 1900 wrote to memory of 1776	1900	464464b0f26f533bb0c6f48a744bf334.exe	iexplore.exe
PID 1900 wrote to memory of 1776	1900	464464b0f26f533bb0c6f48a744bf334.exe	iexplore.exe
PID 1900 wrote to memory of 1776	1900	464464b0f26f533bb0c6f48a744bf334.exe	iexplore.exe
PID 1776 wrote to memory of 460	1776	iexplore.exe	IEXPLORE.EXE
PID 1776 wrote to memory of 460	1776	iexplore.exe	IEXPLORE.EXE
PID 1776 wrote to memory of 460	1776	iexplore.exe	IEXPLORE.EXE
PID 1776 wrote to memory of 460	1776	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\464464b0f26f533bb0c6f48a744bf334.exe
"C:\Users\Admin\AppData\Local\Temp\464464b0f26f533bb0c6f48a744bf334.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1900

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1980

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg
2⤵
- Runs .reg file with regedit
PID:1180

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1lBhp.html
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1776 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:460

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
1f6e2424d4cef4fb05c640df6b1bef80

SHA1
9f6682868a01f4c219fdc277df8f44d9f3df30fc

SHA256
c86e72d4f676982b9d3b79343d29f604a3402c42bb6f38a672f5162191627990

SHA512
c7511146d3603b395b65cc66a239142ca1c16a2498d6e901c311328bc2d8f29ec9b2151b239fce13ab90148d24cb45f0794cd13592827f5cc4209a918fe66769

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
4a766071eeea7aac8c865b2e49bdbde1

SHA1
84781e5eca1c71acf61385c6181426a676cf0965

SHA256
5f8f127c255421537dae84d42c7a7d30fee47ffe1978c53f113e37b3918d1fec

SHA512
292b578cfb684664aab7aac17cdd2d9bde40d5696f9238d2eccf4a08c5883c6e54923690889e44970e87e47e16e716d59c436bb02f8b00d190750c769dcc4acf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w5ukms8\imagestore.dat
MD5
82fabbbf4c759686c6f71bbe840b201f

SHA1
9280b6093c8cfd9556accfb0ff36642b7fe2f1ad

SHA256
7ccc9dad56da911a906ff70e125801f955ba4f1aa0aa2ff27359e292e0c1b706

SHA512
80d3aa4b0a4406c792440b069d2a2083eb86a20637af8b863d8908882e1b9e7ce818ca33725ab186adcd4efc2db7b27ec8712edab1917df30d4fb769e0a620cf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\K532L4H8.txt
MD5
9f1eb2693490facfa6324b5814fe7398

SHA1
cfac4b90d399da02b88e92910222ebfa9187d069

SHA256
bd49a28b5d84d5dd51bf3ea57f004ef9a2887d77d884b1fc8bee59fcd999b015

SHA512
4fc04c93eae289d36e45e5416d70428e5da2ee1845d6bc5d079db064f27796eb63b2feba44c76d5b2be711c090aab9632aa9d9c2227d0ca08523f963ac5f8c0d

Download Submit
\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
1f6e2424d4cef4fb05c640df6b1bef80

SHA1
9f6682868a01f4c219fdc277df8f44d9f3df30fc

SHA256
c86e72d4f676982b9d3b79343d29f604a3402c42bb6f38a672f5162191627990

SHA512
c7511146d3603b395b65cc66a239142ca1c16a2498d6e901c311328bc2d8f29ec9b2151b239fce13ab90148d24cb45f0794cd13592827f5cc4209a918fe66769

Download Submit
\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
1f6e2424d4cef4fb05c640df6b1bef80

SHA1
9f6682868a01f4c219fdc277df8f44d9f3df30fc

SHA256
c86e72d4f676982b9d3b79343d29f604a3402c42bb6f38a672f5162191627990

SHA512
c7511146d3603b395b65cc66a239142ca1c16a2498d6e901c311328bc2d8f29ec9b2151b239fce13ab90148d24cb45f0794cd13592827f5cc4209a918fe66769

Download Submit
memory/460-9-0x0000000000000000-mapping.dmp

Download
memory/1180-4-0x0000000000000000-mapping.dmp

Download
memory/1776-5-0x0000000000000000-mapping.dmp

Download
memory/1792-6-0x000007FEF5AE0000-0x000007FEF5D5A000-memory.dmp

Filesize
2.5MB

Download
memory/1980-8-0x0000000000D00000-0x0000000000D11000-memory.dmp

Filesize
68KB

Download
memory/1980-7-0x0000000000A88000-0x0000000000A99000-memory.dmp

Filesize
68KB

Download
memory/1980-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads