vidar | 30ee19d9f9b1e7c313c08903a1d5150461447f5fd989e82a982c1b6462698c4f

General

Target

a0389694589a21bcb64b48e7b0f18984.exe
Size

617KB
MD5

a0389694589a21bcb64b48e7b0f18984
SHA1

711abe5f72cf9df58e3ff4a8b344fc860c938cea
SHA256

30ee19d9f9b1e7c313c08903a1d5150461447f5fd989e82a982c1b6462698c4f
SHA512

67d99ca1d89158830e0eeba1db6ff2add0e295d6c58e99df1e24f8abbeace072cdbdd269368d33b4cdf3c51a0db8980e04dd42e47ebc7a69c20fb7361e8ecd1f

Score

10^/10

vidar discovery stealer

Malware Config

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Executes dropped EXE 1 IoCs

Processes:

wotsuper.exe

pid process

1188 wotsuper.exe
Loads dropped DLL 2 IoCs

Processes:

a0389694589a21bcb64b48e7b0f18984.exe

pid process

1644 a0389694589a21bcb64b48e7b0f18984.exe
1644 a0389694589a21bcb64b48e7b0f18984.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
1188	wotsuper.exe

pid	process
1644	a0389694589a21bcb64b48e7b0f18984.exe
1644	a0389694589a21bcb64b48e7b0f18984.exe

Drops file in Program Files directory 3 IoCs

Processes:

a0389694589a21bcb64b48e7b0f18984.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe	a0389694589a21bcb64b48e7b0f18984.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.exe	a0389694589a21bcb64b48e7b0f18984.exe
File created	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.ini	a0389694589a21bcb64b48e7b0f18984.exe

Drops file in Windows directory 1 IoCs

Processes:

a0389694589a21bcb64b48e7b0f18984.exe

description ioc process

File opened for modification C:\Windows\wotsuper.reg a0389694589a21bcb64b48e7b0f18984.exe

description	ioc	process
File opened for modification	C:\Windows\wotsuper.reg	a0389694589a21bcb64b48e7b0f18984.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{64947061-22F0-11EB-BD24-DA18B1AB4242} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000f8c12ec5f8048f8dbe016396b4916112143536861c31894b73bf75d31cb70157000000000e8000000002000020000000022df6e39656c9bd39d4ccdcd7ea1a64743200cf2d7e3f143d295b1f29c2765590000000944fe11db806fff2f30beb3894efc63fc407489b0da6c2f593076d8f87c460b0f1ab223c67cbe602f5556882cb9b06d8fe7b71534950b25abd8fe1f384d83921e6708d7512a89f45189029705e815e8b9c635dc64ee648f01e945c825d25f1302abd710e19da89275ea9daeb832696796b68e8700919f710c4b9c22f661329a5b64f1d7e9968e1feea930a60544237a1400000009ab1fde02046e5fcc319fdf89da700197fb7e1d8b9d86125540644e62d7f246d1b71d8b29564b7806ee3a1ba6dd3356f33cf57a5abec141a5d1e62517bc03b5a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303eff3cfdb6d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a60000000000200000000001066000000010000200000004bf68c19b419bd028f411cd897f47ca95420593f7cfd7cc1a1f0fadc6ab31ae7000000000e80000000020000200000003a220ab912b3d3af996e49c5117042d6306195078b13dd8061745114a1239a5b2000000026d7062e5d9b00608a4a971a02ff698df19f360d7dcc1a043a80da9bf0bc2cb340000000dbd4172fd9bda19f6212311acd6217c9a00c711f695c305432f15f6057d6d4bc5d880a6817d49b973d2a077a70ec8bfef798019eb2f82a92c8321cf4283aca5b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "311735120"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

1208 regedit.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

wotsuper.exe

pid process

1188 wotsuper.exe
1188 wotsuper.exe
1188 wotsuper.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1140 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1140 iexplore.exe
1140 iexplore.exe
1088 IEXPLORE.EXE
1088 IEXPLORE.EXE
1088 IEXPLORE.EXE
1088 IEXPLORE.EXE

pid	process
1208	regedit.exe

pid	process
1188	wotsuper.exe
1188	wotsuper.exe
1188	wotsuper.exe

pid	process
1140	iexplore.exe

pid	process
1140	iexplore.exe
1140	iexplore.exe
1088	IEXPLORE.EXE
1088	IEXPLORE.EXE
1088	IEXPLORE.EXE
1088	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

a0389694589a21bcb64b48e7b0f18984.exeiexplore.exe

description	pid	process	target process
PID 1644 wrote to memory of 1188	1644	a0389694589a21bcb64b48e7b0f18984.exe	wotsuper.exe
PID 1644 wrote to memory of 1188	1644	a0389694589a21bcb64b48e7b0f18984.exe	wotsuper.exe
PID 1644 wrote to memory of 1188	1644	a0389694589a21bcb64b48e7b0f18984.exe	wotsuper.exe
PID 1644 wrote to memory of 1188	1644	a0389694589a21bcb64b48e7b0f18984.exe	wotsuper.exe
PID 1644 wrote to memory of 1208	1644	a0389694589a21bcb64b48e7b0f18984.exe	regedit.exe
PID 1644 wrote to memory of 1208	1644	a0389694589a21bcb64b48e7b0f18984.exe	regedit.exe
PID 1644 wrote to memory of 1208	1644	a0389694589a21bcb64b48e7b0f18984.exe	regedit.exe
PID 1644 wrote to memory of 1208	1644	a0389694589a21bcb64b48e7b0f18984.exe	regedit.exe
PID 1644 wrote to memory of 1140	1644	a0389694589a21bcb64b48e7b0f18984.exe	iexplore.exe
PID 1644 wrote to memory of 1140	1644	a0389694589a21bcb64b48e7b0f18984.exe	iexplore.exe
PID 1644 wrote to memory of 1140	1644	a0389694589a21bcb64b48e7b0f18984.exe	iexplore.exe
PID 1644 wrote to memory of 1140	1644	a0389694589a21bcb64b48e7b0f18984.exe	iexplore.exe
PID 1140 wrote to memory of 1088	1140	iexplore.exe	IEXPLORE.EXE
PID 1140 wrote to memory of 1088	1140	iexplore.exe	IEXPLORE.EXE
PID 1140 wrote to memory of 1088	1140	iexplore.exe	IEXPLORE.EXE
PID 1140 wrote to memory of 1088	1140	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\a0389694589a21bcb64b48e7b0f18984.exe
"C:\Users\Admin\AppData\Local\Temp\a0389694589a21bcb64b48e7b0f18984.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1644

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1188

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg
2⤵
- Runs .reg file with regedit
PID:1208

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1lBhp.html
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1140 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1088

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
3990858d0d8abbb0065939a7f77baa16

SHA1
61f9aa5d315f39633ed00264cb685d5af209a42a

SHA256
05a51157867e170957ef468e8d825738e3c109abf384a5da37d17307da65fac5

SHA512
4f84be5c856865501cac5c43f7c23afc4810c9befbafd7fc8fe77fc25c7e23b0d0be929103e53717a983c795116e57cec31170198f3c725eececa44751b8aaf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
ba51b250875437c8c7bdb7b4361f2596

SHA1
bfee571c60a4e41615cd3e76cddee79cbcc8c0c7

SHA256
0e6aa7ce34b0c9aef2ec06a30d76ee14d3d8e84fed4d420251d03638e2809edb

SHA512
356387144fff6cffeece0d754f53127b1b6d2c0a41029e00f915a8c4d9c1ebaf098e44b539f363ce28f8d662de73bdc697f2b2eee2f9bd75e03dddafece11d49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w5ukms8\imagestore.dat
MD5
2ed3a5201320e8a4ca7e9a414b3ec80d

SHA1
43a66058f41335390fce68e5dc313e50a8fb6aeb

SHA256
6c670b96338f22bfbaaab31d00deb4d86e97258c5af391d06493b3fc3577d11b

SHA512
68b0e5aa862cfd3ba89dff11505a4d968145603aa5aafecfd9f768ed05ac14225283e3f560fc256d005af7fe91b0accc9326b8f159964aa0a9a426aca8f0b5ec

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\RVURGGF9.txt
MD5
80345970a4323ae522d9dab0fb3aae23

SHA1
43fbd5902ed0412f7ec793000fba52a7a76b8ad2

SHA256
e8208aeada09e9ce3ceb8534c21fb68665e41d53dedc2cb25b844335053c2557

SHA512
f56d4bad2bae6291e5646742f6ac05cf1290ba7a326d4832d12a289f4bca0f521247088f607ea3da96f20093f38b406cd0d9602af9153f7085b604caf075c9c7

Download Submit
\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
3990858d0d8abbb0065939a7f77baa16

SHA1
61f9aa5d315f39633ed00264cb685d5af209a42a

SHA256
05a51157867e170957ef468e8d825738e3c109abf384a5da37d17307da65fac5

SHA512
4f84be5c856865501cac5c43f7c23afc4810c9befbafd7fc8fe77fc25c7e23b0d0be929103e53717a983c795116e57cec31170198f3c725eececa44751b8aaf4

Download Submit
\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
3990858d0d8abbb0065939a7f77baa16

SHA1
61f9aa5d315f39633ed00264cb685d5af209a42a

SHA256
05a51157867e170957ef468e8d825738e3c109abf384a5da37d17307da65fac5

SHA512
4f84be5c856865501cac5c43f7c23afc4810c9befbafd7fc8fe77fc25c7e23b0d0be929103e53717a983c795116e57cec31170198f3c725eececa44751b8aaf4

Download Submit
memory/896-6-0x000007FEF7B10000-0x000007FEF7D8A000-memory.dmp

Filesize
2.5MB

Download
memory/1088-9-0x0000000000000000-mapping.dmp

Download
memory/1140-5-0x0000000000000000-mapping.dmp

Download
memory/1188-8-0x0000000000B40000-0x0000000000B51000-memory.dmp

Filesize
68KB

Download
memory/1188-7-0x00000000002B8000-0x00000000002C9000-memory.dmp

Filesize
68KB

Download
memory/1188-2-0x0000000000000000-mapping.dmp

Download
memory/1208-4-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads