vidar | 01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20

General

Target

01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe
Size

603KB
MD5

fc36426495ee630d0b1b8f01dc716a4a
SHA1

1f8f8d9c120fe300d1f4123bf3b1725a64374dfd
SHA256

01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20
SHA512

8c3af38acb8e9a49aba600eeac8037158ded7f51cfcbf80550cc0d8ca0cf97c7d9a4d600e68050353680e465ea2dab09dd1b20dccfc47c9aa24dd6793d6dbea8
SSDEEP

12288:WE/uGuw1DPs5P9PTxy9bd46JgqPMQhB6NLKdLhTh3QHQIE:WkueDcVTxy9jgtQKiTgHQIE

Score

10^/10

vidar 1375 spyware stealer

Malware Config

Extracted

Family

vidar

Version

54.3

Botnet

1375

C2

https://t.me/karacakahve

https://ieji.de/@tiagoa96

Attributes

profile_id
1375

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Loads dropped DLL 3 IoCs

Processes:

AppLaunch.exe

pid process

99572 AppLaunch.exe
99572 AppLaunch.exe
99572 AppLaunch.exe
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
99572	AppLaunch.exe
99572	AppLaunch.exe
99572	AppLaunch.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe

description	pid	process	target process
PID 544 set thread context of 99572	544	01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

99620 544 WerFault.exe 01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe

pid	pid_target	process	target process
99620	544	WerFault.exe	01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AppLaunch.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

AppLaunch.exe

pid process

99572 AppLaunch.exe

pid	process
99572	AppLaunch.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe

description	pid	process	target process
PID 544 wrote to memory of 99572	544	01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe	AppLaunch.exe
PID 544 wrote to memory of 99572	544	01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe	AppLaunch.exe
PID 544 wrote to memory of 99572	544	01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe	AppLaunch.exe
PID 544 wrote to memory of 99572	544	01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe	AppLaunch.exe
PID 544 wrote to memory of 99572	544	01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe	AppLaunch.exe
PID 544 wrote to memory of 99572	544	01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe	AppLaunch.exe
PID 544 wrote to memory of 99572	544	01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe	AppLaunch.exe
PID 544 wrote to memory of 99572	544	01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe	AppLaunch.exe
PID 544 wrote to memory of 99572	544	01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe	AppLaunch.exe
PID 544 wrote to memory of 99620	544	01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe	WerFault.exe
PID 544 wrote to memory of 99620	544	01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe	WerFault.exe
PID 544 wrote to memory of 99620	544	01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe	WerFault.exe
PID 544 wrote to memory of 99620	544	01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe
"C:\Users\Admin\AppData\Local\Temp\01dd09f52d0accfd655731ed746a9c3742dc7ee7684aa5a4002155897147dc20.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:99572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 98252
  2⤵
  - Program crash
  PID:99620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
\ProgramData\sqlite3.dll

Filesize
1.1MB

MD5
1f44d4d3087c2b202cf9c90ee9d04b0f

SHA1
106a3ebc9e39ab6ddb3ff987efb6527c956f192d

SHA256
4841020c8bd06b08fde6e44cbe2e2ab33439e1c8368e936ec5b00dc0584f7260

SHA512
b614c72a3c1ce681ebffa628e29aa50275cc80ca9267380960c5198ea4d0a3f2df6cfb7275491d220bad72f14fc94e6656501e9a061d102fb11e00cfda2beb45

Download Submit
memory/99572-54-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/99572-56-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/99572-62-0x000000000042108D-mapping.dmp

Download
memory/99572-63-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/99572-64-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/99572-65-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/99620-66-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads