vidar | b10274561191cedb0b16d2a69fdcd4e5062edfe2621842eacd55945ffded3f57

Analysis

max time kernel
14s
max time network
156s
platform
windows7_x64
resource
win7-en-20211014
submitted
26/11/2021, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe
Size 3.6MB
Sample211126-txhpqaddgr
SHA256 b10274561191cedb0b16d2a69fdcd4e5062edfe2621842eacd55945ffded3f57
MD5 19008dabdac3c666e9006648027c4754
SHA1 6a054be41ac9a5badab8d38552b8703c12b33cca
SHA512 83ff9b3b897055039061abcf65f46cfb2dbe8c418c4f959a2727f49035a361f541a1e2f511463cbd7449d0cb4828b6ae66290e1a6ed917d1b0d408d4bd90450b
MD5 SHA1 SHA512

Score

10^/10

vidar 706 aspackv2 stealer

Malware Config

Extracted

Family

vidar

Version

40.2

Botnet

https://kipriauka.tumblr.com/

Attributes

profile_id
706

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/1916-165-0x0000000000400000-0x0000000000595000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000700000001221a-66.dat	aspack_v212_v242
behavioral1/files/0x000700000001221a-65.dat	aspack_v212_v242
behavioral1/files/0x0007000000012220-64.dat	aspack_v212_v242
behavioral1/files/0x0007000000012220-63.dat	aspack_v212_v242
behavioral1/files/0x0006000000012239-70.dat	aspack_v212_v242
behavioral1/files/0x0006000000012239-69.dat	aspack_v212_v242

Executes dropped EXE 4 IoCs

pid	Process
856	setup_install.exe
1300	Tue0699904d3988.exe
1896	Tue06fef1eb6915a54.exe
916	Tue06a05305b6ee3.exe

Loads dropped DLL 19 IoCs

pid	Process
376	B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe
376	B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe
376	B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe
856	setup_install.exe
856	setup_install.exe
856	setup_install.exe
856	setup_install.exe
856	setup_install.exe
856	setup_install.exe
856	setup_install.exe
856	setup_install.exe
828	cmd.exe
276	cmd.exe
1056	cmd.exe
1212	cmd.exe
1056	cmd.exe
1896	Tue06fef1eb6915a54.exe
1896	Tue06fef1eb6915a54.exe
1980	cmd.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
51	ipinfo.io
52	ipinfo.io
7	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1168	856	WerFault.exe	28
2100	1916	WerFault.exe	42

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 856	376	B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe	28
PID 376 wrote to memory of 856	376	B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe	28
PID 376 wrote to memory of 856	376	B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe	28
PID 376 wrote to memory of 856	376	B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe	28
PID 376 wrote to memory of 856	376	B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe	28
PID 376 wrote to memory of 856	376	B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe	28
PID 376 wrote to memory of 856	376	B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe	28
PID 856 wrote to memory of 1036	856	setup_install.exe	49
PID 856 wrote to memory of 1036	856	setup_install.exe	49
PID 856 wrote to memory of 1036	856	setup_install.exe	49
PID 856 wrote to memory of 1036	856	setup_install.exe	49
PID 856 wrote to memory of 1036	856	setup_install.exe	49
PID 856 wrote to memory of 1036	856	setup_install.exe	49
PID 856 wrote to memory of 1036	856	setup_install.exe	49
PID 856 wrote to memory of 276	856	setup_install.exe	48
PID 856 wrote to memory of 276	856	setup_install.exe	48
PID 856 wrote to memory of 276	856	setup_install.exe	48
PID 856 wrote to memory of 276	856	setup_install.exe	48
PID 856 wrote to memory of 276	856	setup_install.exe	48
PID 856 wrote to memory of 276	856	setup_install.exe	48
PID 856 wrote to memory of 276	856	setup_install.exe	48
PID 856 wrote to memory of 1868	856	setup_install.exe	47
PID 856 wrote to memory of 1868	856	setup_install.exe	47
PID 856 wrote to memory of 1868	856	setup_install.exe	47
PID 856 wrote to memory of 1868	856	setup_install.exe	47
PID 856 wrote to memory of 1868	856	setup_install.exe	47
PID 856 wrote to memory of 1868	856	setup_install.exe	47
PID 856 wrote to memory of 1868	856	setup_install.exe	47
PID 856 wrote to memory of 828	856	setup_install.exe	46
PID 856 wrote to memory of 828	856	setup_install.exe	46
PID 856 wrote to memory of 828	856	setup_install.exe	46
PID 856 wrote to memory of 828	856	setup_install.exe	46
PID 856 wrote to memory of 828	856	setup_install.exe	46
PID 856 wrote to memory of 828	856	setup_install.exe	46
PID 856 wrote to memory of 828	856	setup_install.exe	46
PID 856 wrote to memory of 1056	856	setup_install.exe	30
PID 856 wrote to memory of 1056	856	setup_install.exe	30
PID 856 wrote to memory of 1056	856	setup_install.exe	30
PID 856 wrote to memory of 1056	856	setup_install.exe	30
PID 856 wrote to memory of 1056	856	setup_install.exe	30
PID 856 wrote to memory of 1056	856	setup_install.exe	30
PID 856 wrote to memory of 1056	856	setup_install.exe	30
PID 856 wrote to memory of 1212	856	setup_install.exe	31
PID 856 wrote to memory of 1212	856	setup_install.exe	31
PID 856 wrote to memory of 1212	856	setup_install.exe	31
PID 856 wrote to memory of 1212	856	setup_install.exe	31
PID 856 wrote to memory of 1212	856	setup_install.exe	31
PID 856 wrote to memory of 1212	856	setup_install.exe	31
PID 856 wrote to memory of 1212	856	setup_install.exe	31
PID 856 wrote to memory of 296	856	setup_install.exe	45
PID 856 wrote to memory of 296	856	setup_install.exe	45
PID 856 wrote to memory of 296	856	setup_install.exe	45
PID 856 wrote to memory of 296	856	setup_install.exe	45
PID 856 wrote to memory of 296	856	setup_install.exe	45
PID 856 wrote to memory of 296	856	setup_install.exe	45
PID 856 wrote to memory of 296	856	setup_install.exe	45
PID 856 wrote to memory of 1884	856	setup_install.exe	44
PID 856 wrote to memory of 1884	856	setup_install.exe	44
PID 856 wrote to memory of 1884	856	setup_install.exe	44
PID 856 wrote to memory of 1884	856	setup_install.exe	44
PID 856 wrote to memory of 1884	856	setup_install.exe	44
PID 856 wrote to memory of 1884	856	setup_install.exe	44
PID 856 wrote to memory of 1884	856	setup_install.exe	44
PID 828 wrote to memory of 1300	828	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe
"C:\Users\Admin\AppData\Local\Temp\B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:376
- C:\Users\Admin\AppData\Local\Temp\7zS87143A06\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS87143A06\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue0634f55dcf1.exe
    3⤵
    - Loads dropped DLL
    PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\7zS87143A06\Tue0634f55dcf1.exe
      Tue0634f55dcf1.exe
      4⤵
      PID:1916
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 964
        5⤵
        Program crash
        
        PID:2100
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue06a05305b6ee3.exe
    3⤵
    - Loads dropped DLL
    PID:1212
  - - C:\Users\Admin\AppData\Local\Temp\7zS87143A06\Tue06a05305b6ee3.exe
      Tue06a05305b6ee3.exe
      4⤵
      Executes dropped EXE
      PID:916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 436
    3⤵
    - Program crash
    PID:1168
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue06490e70c2.exe
    3⤵
    - Loads dropped DLL
    PID:1980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue062aa86676e1a963.exe
    3⤵
    PID:1464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue06481b746d289c.exe
    3⤵
    PID:1884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue0676b4d32ba71a3.exe
    3⤵
    PID:296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue0699904d3988.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue0631100942b.exe
    3⤵
    PID:1868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue06fef1eb6915a54.exe
    3⤵
    - Loads dropped DLL
    PID:276
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:1036

C:\Users\Admin\AppData\Local\Temp\7zS87143A06\Tue0699904d3988.exe
Tue0699904d3988.exe
1⤵
- Executes dropped EXE
PID:1300

C:\Users\Admin\AppData\Local\Temp\7zS87143A06\Tue06fef1eb6915a54.exe
Tue06fef1eb6915a54.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896
- C:\Users\Admin\AppData\Local\Temp\7zS87143A06\Tue06fef1eb6915a54.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS87143A06\Tue06fef1eb6915a54.exe" -u
  2⤵
  PID:1632

C:\Users\Admin\AppData\Local\Temp\7zS87143A06\Tue06490e70c2.exe
Tue06490e70c2.exe
1⤵
PID:1904

C:\Users\Admin\AppData\Local\Temp\7zS87143A06\Tue0676b4d32ba71a3.exe
Tue0676b4d32ba71a3.exe
1⤵
PID:776

C:\Users\Admin\AppData\Local\Temp\7zS87143A06\Tue06481b746d289c.exe
Tue06481b746d289c.exe
1⤵
PID:1592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/376-55-0x0000000074F61000-0x0000000074F63000-memory.dmp

Download

memory/776-184-0x0000000004140000-0x000000000428C000-memory.dmp

Download

memory/856-86-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/856-78-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/856-90-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/856-82-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/856-80-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/856-76-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/856-77-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/856-81-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/856-84-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/856-83-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/856-85-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/856-79-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/856-94-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/856-87-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/856-89-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1168-167-0x0000000000260000-0x0000000000261000-memory.dmp

Download

memory/1592-174-0x000000001AD70000-0x000000001AD72000-memory.dmp

Download

memory/1592-169-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/1592-172-0x0000000000270000-0x0000000000286000-memory.dmp

Download

memory/1904-173-0x000000001B190000-0x000000001B192000-memory.dmp

Download

memory/1904-168-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Download

memory/1916-149-0x0000000000700000-0x000000000077B000-memory.dmp

Download

memory/1916-160-0x0000000000BB0000-0x0000000000D45000-memory.dmp

Download

memory/1916-165-0x0000000000400000-0x0000000000595000-memory.dmp

Download

memory/2100-181-0x00000000002E0000-0x00000000002E1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads