Overview

overview

10

Static

static

bd689c832f...33.exe

windows7_x64

10

bd689c832f...33.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bd689c832f8ff3c83da935ac35bf03d8bca2dd90ce0de9a58404e572e93d0a33

  • Size

    1.1MB

  • Sample

    211220-rd746abegj

  • MD5

    5607de016f1a16d6429596c4ddf45b15

  • SHA1

    fcb85c8cc4ad05e616c0632d7ab0e3509afb8209

  • SHA256

    bd689c832f8ff3c83da935ac35bf03d8bca2dd90ce0de9a58404e572e93d0a33

  • SHA512

    68c7182823a6c5e1896967a1b5cf6e40efd6bb938c130fb0818a8aaeb88deb7af3da1a03a207743e57cbb4d3a82126653ead09e26c82d3b119ed59d6e565a186

Score
10/10
vidarxmrig903discoveryevasionminerspywarestealersuricatatrojan

Malware Config

Extracted

Family

vidar

Version

49.1

Botnet

903

C2

https://noc.social/@sergeev46

https://c.im/@sergeev47
Attributes
  • profile_id

    903

Targets

    • Target

      bd689c832f8ff3c83da935ac35bf03d8bca2dd90ce0de9a58404e572e93d0a33

    • Size

      1.1MB

    • MD5

      5607de016f1a16d6429596c4ddf45b15

    • SHA1

      fcb85c8cc4ad05e616c0632d7ab0e3509afb8209

    • SHA256

      bd689c832f8ff3c83da935ac35bf03d8bca2dd90ce0de9a58404e572e93d0a33

    • SHA512

      68c7182823a6c5e1896967a1b5cf6e40efd6bb938c130fb0818a8aaeb88deb7af3da1a03a207743e57cbb4d3a82126653ead09e26c82d3b119ed59d6e565a186

    Score
    10/10
    vidar903discoveryevasionspywarestealersuricatatrojanxmrigminer

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

      suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

      suricata

    • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

      suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

      suricata

    • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

      suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

      suricata

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Vidar Stealer

      stealer

    • Disables taskbar notifications via registry modification

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks