Analysis

  • max time kernel
    163s
  • max time network
    176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    15-02-2022 14:56

General

  • Target

    2445015a38add6e9f4e917b8057e57cd59c5361aed5ddec6b6f3ac64c0cda258.exe

  • Size

    708KB

  • MD5

    9c18b1d03dfef684145efdaf64ef2c25

  • SHA1

    8a038d5a59ec994afdb558658c5ee1f92d690288

  • SHA256

    2445015a38add6e9f4e917b8057e57cd59c5361aed5ddec6b6f3ac64c0cda258

  • SHA512

    defec70294504707ccc36317d5875e6462e1db0cb75b9bbd68595755aadac41daac416ab4a49abee6ef3a06a026e48d03fd8ff745d96500cb5674c70d751d04f

Score
10/10

Malware Config

Extracted

Family

vidar

Version

48.6

Botnet

937

C2

https://mastodon.online/@valhalla

https://koyu.space/@valhalla

Attributes
  • profile_id

    937

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2445015a38add6e9f4e917b8057e57cd59c5361aed5ddec6b6f3ac64c0cda258.exe
    "C:\Users\Admin\AppData\Local\Temp\2445015a38add6e9f4e917b8057e57cd59c5361aed5ddec6b6f3ac64c0cda258.exe"
    1⤵
      PID:2520
    • C:\Windows\system32\MusNotifyIcon.exe
      %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
      1⤵
      • Checks processor information in registry
      PID:3672
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      PID:3016
    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1144

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2520-130-0x00000000021BD000-0x0000000002239000-memory.dmp
      Filesize

      496KB

    • memory/2520-131-0x00000000021BD000-0x0000000002239000-memory.dmp
      Filesize

      496KB

    • memory/2520-132-0x0000000003D80000-0x0000000003E55000-memory.dmp
      Filesize

      852KB

    • memory/2520-133-0x0000000000400000-0x00000000004D8000-memory.dmp
      Filesize

      864KB