vidar | aebfbaf72b832cf446789cedf82459f71587f48b2d44998d64215fafaf4b5fb6

General

Target

d790fed581ba982731fc4257763d93b2.exe
Size

1.9MB
MD5

d790fed581ba982731fc4257763d93b2
SHA1

f91dbf1e6e81b266a1cfa1fe307fcd3b9d491b27
SHA256

aebfbaf72b832cf446789cedf82459f71587f48b2d44998d64215fafaf4b5fb6
SHA512

a207b39908c480c25c7d33b56ed6b6f6a3c16ff5624d12537bac6972a847ae7cb82736b5d52dcae25e36494e6144309101e177fde5a2c42bc23ae59dd4c150b1

Score

10^/10

vidar 909 stealer

Malware Config

Extracted

Family

vidar

Version

50.8

Botnet

909

C2

https://ieji.de/@sam7al

https://ru.social/@s4m74l

Attributes

profile_id
909

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/4028-146-0x0000000000400000-0x00000000004B1000-memory.dmp	family_vidar
behavioral2/memory/4028-147-0x0000000000400000-0x00000000004B1000-memory.dmp	family_vidar
behavioral2/memory/4028-148-0x0000000000400000-0x00000000004B1000-memory.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

d790fed581ba982731fc4257763d93b2.exe

description pid process target process

PID 648 set thread context of 4028 648 d790fed581ba982731fc4257763d93b2.exe fsutil.exe

description	pid	process	target process
PID 648 set thread context of 4028	648	d790fed581ba982731fc4257763d93b2.exe	fsutil.exe

Drops file in Windows directory 62 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\BITF8A7.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\YZBnsYBVNBTl3Isrrjy7P0\FTTOLXxEZk0li+ZNE2Uo=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\BITA3E3.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\6feeefdf55ac33c2cb46a25670952111\2cd32031792245e69c7777193005916861cbbe94	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\6feeefdf55ac33c2cb46a25670952111\o\egfDu3QHOC\BITBE87.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\BITFB29.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\a3f602ea4d534d006919a2613d91f9506b383314	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT8870.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\c3ca3df6b0660cc02fa0c60992eb1164c186b223	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\daNJ9YVgpN191GzoPynRDpTEDO9uUytOK6Ln7xcN8To=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\BIT36D9.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\BITA0B4.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\d9f2a302574bf135efc9dbd1a8083a336f7f52f0	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\BITAACB.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\6\BITF6CF.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT3A38.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT88B0.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT97C7.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\Jda7di8befpfPWz3DrhkMwwJL9XbuL8\BITA375.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\YZBnsYBVNBTl3Isrrjy7P0\BITA9DF.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT395B.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\BIT3A27.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\e1a85885fd4453165061351651289cce8f8590c4	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\6e15245aed25ee83b027521f9cf9ea812c9d016d	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\Cmn5TH6S2lFFnfMN8MLr2EoNUIAGzQo2UUjHGMEC99A=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\F2WKV54ysEMEW9U+EfiUeJcNcgfNL4pMC5NmE0a3mAg=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\fbaaae7103d0f0a1303a40d280aa18bafcd08dcf	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\BIT4E0.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\5ondRmJ90JlkPETuN535TWk=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\LZOCjtiHKk8=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT8E4F.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\6feeefdf55ac33c2cb46a25670952111\BITB33B.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\BITF78B.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\9+dL4Puh6FM8puPxsBEX86BMeGqpuC0b7gf2fD9DLLo=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT8DC2.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\6feeefdf55ac33c2cb46a25670952111\o\egfDu3QHOC\Xbfe7KpvVnvJHxQ2cRDBmUlnoMnpDY=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\6\v9GXr9MSfUt92b0dEpOsHH2H0TwcnvKmtIW8g3ovM=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\f3535a3b47819a04c6d5ee18905493be086e801e	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\Jda7di8befpfPWz3DrhkMwwJL9XbuL8\BIT9F98.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\Jda7di8befpfPWz3DrhkMwwJL9XbuL8\fDFnweOZvFE=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\6\BITFAAB.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT8197.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\BITF7EA.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\6feeefdf55ac33c2cb46a25670952111\o\egfDu3QHOC\BITB069.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT8812.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\af66e12c1bb9d8519da21259d0fcd88c247cb4f1	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\6feeefdf55ac33c2cb46a25670952111\BITBF14.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\BIT413.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\BIT4920.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT8119.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT8746.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT96DC.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\YZBnsYBVNBTl3Isrrjy7P0\BITA055.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\BITA0D4.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\6feeefdf55ac33c2cb46a25670952111\o\egfDu3QHOC\BITB25F.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\BIT3570.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\BIT361D.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\BIT44F7.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\612ad442b8740f4c57b8c84e6bf465ba4699118c	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\BIT4575.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\BIT4883.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\6feeefdf55ac33c2cb46a25670952111\BITB106.tmp	svchost.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4172 4028 WerFault.exe fsutil.exe
Modifies data under HKEY_USERS 1 IoCs

Processes:

svchost.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe

pid	pid_target	process	target process
4172	4028	WerFault.exe	fsutil.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

d790fed581ba982731fc4257763d93b2.exe

pid	process
648	d790fed581ba982731fc4257763d93b2.exe
648	d790fed581ba982731fc4257763d93b2.exe
648	d790fed581ba982731fc4257763d93b2.exe
648	d790fed581ba982731fc4257763d93b2.exe
648	d790fed581ba982731fc4257763d93b2.exe
648	d790fed581ba982731fc4257763d93b2.exe
648	d790fed581ba982731fc4257763d93b2.exe
648	d790fed581ba982731fc4257763d93b2.exe
648	d790fed581ba982731fc4257763d93b2.exe
648	d790fed581ba982731fc4257763d93b2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d790fed581ba982731fc4257763d93b2.exe

description pid process

Token: SeDebugPrivilege 648 d790fed581ba982731fc4257763d93b2.exe

description	pid	process
Token: SeDebugPrivilege	648	d790fed581ba982731fc4257763d93b2.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

d790fed581ba982731fc4257763d93b2.exe

description	pid	process	target process
PID 648 wrote to memory of 4028	648	d790fed581ba982731fc4257763d93b2.exe	fsutil.exe
PID 648 wrote to memory of 4028	648	d790fed581ba982731fc4257763d93b2.exe	fsutil.exe
PID 648 wrote to memory of 4028	648	d790fed581ba982731fc4257763d93b2.exe	fsutil.exe
PID 648 wrote to memory of 4028	648	d790fed581ba982731fc4257763d93b2.exe	fsutil.exe
PID 648 wrote to memory of 4028	648	d790fed581ba982731fc4257763d93b2.exe	fsutil.exe
PID 648 wrote to memory of 4028	648	d790fed581ba982731fc4257763d93b2.exe	fsutil.exe
PID 648 wrote to memory of 4028	648	d790fed581ba982731fc4257763d93b2.exe	fsutil.exe
PID 648 wrote to memory of 4028	648	d790fed581ba982731fc4257763d93b2.exe	fsutil.exe
PID 648 wrote to memory of 4028	648	d790fed581ba982731fc4257763d93b2.exe	fsutil.exe
PID 648 wrote to memory of 4028	648	d790fed581ba982731fc4257763d93b2.exe	fsutil.exe

C:\Users\Admin\AppData\Local\Temp\d790fed581ba982731fc4257763d93b2.exe
"C:\Users\Admin\AppData\Local\Temp\d790fed581ba982731fc4257763d93b2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\SysWOW64\fsutil.exe
"C:\Windows\SysWOW64\fsutil.exe"
2⤵
PID:4028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 440
3⤵
- Program crash
PID:4172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4028 -ip 4028
1⤵
PID:2296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-145-0x0000000005230000-0x00000000052CC000-memory.dmp

Filesize
624KB

Download
memory/648-135-0x0000000000750000-0x000000000093E000-memory.dmp

Filesize
1.9MB

Download
memory/648-136-0x0000000005320000-0x00000000053BC000-memory.dmp

Filesize
624KB

Download
memory/648-137-0x0000000005970000-0x0000000005F14000-memory.dmp

Filesize
5.6MB

Download
memory/648-138-0x00000000053C0000-0x0000000005452000-memory.dmp

Filesize
584KB

Download
memory/648-139-0x0000000005230000-0x00000000052CC000-memory.dmp

Filesize
624KB

Download
memory/648-140-0x00000000052E0000-0x00000000052EA000-memory.dmp

Filesize
40KB

Download
memory/648-141-0x00000000055B0000-0x0000000005606000-memory.dmp

Filesize
344KB

Download
memory/648-134-0x0000000074FA0000-0x0000000075750000-memory.dmp

Filesize
7.7MB

Download
memory/648-149-0x0000000071100000-0x0000000071112000-memory.dmp

Filesize
72KB

Download
memory/2964-152-0x000001BB395C0000-0x000001BB395C4000-memory.dmp

Filesize
16KB

Download
memory/2964-154-0x000001BB39890000-0x000001BB39894000-memory.dmp

Filesize
16KB

Download
memory/2964-157-0x000001BB39860000-0x000001BB39864000-memory.dmp

Filesize
16KB

Download
memory/2964-156-0x000001BB39920000-0x000001BB39924000-memory.dmp

Filesize
16KB

Download
memory/2964-155-0x000001BB39890000-0x000001BB39894000-memory.dmp

Filesize
16KB

Download
memory/2964-143-0x000001BB36C60000-0x000001BB36C70000-memory.dmp

Filesize
64KB

Download
memory/2964-150-0x000001BB395C0000-0x000001BB395C4000-memory.dmp

Filesize
16KB

Download
memory/2964-151-0x000001BB395C0000-0x000001BB395C4000-memory.dmp

Filesize
16KB

Download
memory/2964-142-0x000001BB363A0000-0x000001BB363B0000-memory.dmp

Filesize
64KB

Download
memory/2964-153-0x000001BB394D0000-0x000001BB394D1000-memory.dmp

Filesize
4KB

Download
memory/2964-144-0x000001BB39220000-0x000001BB39224000-memory.dmp

Filesize
16KB

Download
memory/4028-148-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/4028-147-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/4028-146-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads