vidar | 532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a

General

Target

532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe
Size

858KB
MD5

d305c0176dc9a1f3daf516e6034f2b57
SHA1

87faa41997ee2187247d117081d46284193fabda
SHA256

532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a
SHA512

8f7ca5e48f4f21d8429d0719caa6dd705d74c466392c1e91d372915aa8e4855789cd288d94567a59d301cc7335e55c8e0836b3280199ee9001149ab6b36a0a8e

Score

10^/10

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
32	0HO018CL5PMY1CLE.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe

Loads dropped DLL 2 IoCs

pid	Process
1452	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe
1452	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\ProgramData\0HO018CL5PMY1CLE.exe:Zone.Identifier	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe
File opened for modification	C:\ProgramData\0HO018CL5PMY1CLE.exe:Zone.Identifier	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1452	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe
1452	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe
1452	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe
1452	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe
1452	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe
1452	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe
1452	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe
1452	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2512	MusNotification.exe
Token: SeCreatePagefilePrivilege	2512	MusNotification.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 32	1452	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe	53
PID 1452 wrote to memory of 32	1452	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe	53
PID 1452 wrote to memory of 32	1452	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe	53
PID 1452 wrote to memory of 3008	1452	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe	54
PID 1452 wrote to memory of 3008	1452	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe	54
PID 1452 wrote to memory of 3008	1452	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe	54

C:\Users\Admin\AppData\Local\Temp\532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe
"C:\Users\Admin\AppData\Local\Temp\532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1452
- C:\ProgramData\0HO018CL5PMY1CLE.exe
  "C:\ProgramData\0HO018CL5PMY1CLE.exe"
  2⤵
  - Executes dropped EXE
  PID:32
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im 532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe" & del C:\ProgramData\*.dll & exit
  2⤵
  PID:3008