General

  • Target

    E4AF1C73101F2AB9F89D04A11986C58A.exe

  • Size

    2.8MB

  • Sample

    210906-vjkslaeecm

  • MD5

    e4af1c73101f2ab9f89d04a11986c58a

  • SHA1

    a6711c9fffe5f192d9e01445ad261ef74b601cfc

  • SHA256

    210353e2c687a7e1e94408ca27cf59fbbec44495d75a3e466ae528a1a33a53ea

  • SHA512

    7f7da803b90d7c2948421e4106edac91899d109adc19c6f264e899ba726e349609bbfdab5051dafcba255becbc3f418fcb0eca2e199f562f51105231c71cfb07

Malware Config

Extracted

Family

vidar

Version

40.1

Botnet

706

C2

https://eduarroma.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

vidar

Version

40.4

Botnet

921

C2

https://romkaxarit.tumblr.com/

Attributes
  • profile_id

    921

Targets

    • Target

      E4AF1C73101F2AB9F89D04A11986C58A.exe

    • Size

      2.8MB

    • MD5

      e4af1c73101f2ab9f89d04a11986c58a

    • SHA1

      a6711c9fffe5f192d9e01445ad261ef74b601cfc

    • SHA256

      210353e2c687a7e1e94408ca27cf59fbbec44495d75a3e466ae528a1a33a53ea

    • SHA512

      7f7da803b90d7c2948421e4106edac91899d109adc19c6f264e899ba726e349609bbfdab5051dafcba255becbc3f418fcb0eca2e199f562f51105231c71cfb07

    • Modifies Windows Defender Real-time Protection settings

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

Modify Registry

2
T1112

Disabling Security Tools

1
T1089

Install Root Certificate

1
T1130

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks