vidar | 434f45359039b25ca4aaca82742c6a5f5317ad2a01c4146a53bc3fc5c2d7703b

General

Target

Set_Yuki_x64.exe
Size

6.1MB
MD5

8a179d54a162d143f19fd7064e361c05
SHA1

4f0cd167e6c22efd4e31357de7e4c66625bf7032
SHA256

434f45359039b25ca4aaca82742c6a5f5317ad2a01c4146a53bc3fc5c2d7703b
SHA512

4112f0f510735b0aa72c2119310aa182354f8aa12d8b9ec4e0c6861de1dcffe4ef491b6e7399de66204e4f4d083f3e879d822a7f3dc7775b86b5c307245b9f16
SSDEEP

24576:uv66t3q/zhIYCpnviF18f5xn/T8BlnpvgSHhD:JsqlRuxn/T8j6s

Score

10^/10

vidar 1325 discovery spyware stealer upx

Malware Config

Extracted

Family

vidar

Version

55.6

Botnet

1325

C2

https://t.me/seclab_new

https://koyu.space/@ofade

Attributes

profile_id
1325

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

01163923245424584181.exe

pid process

1484 01163923245424584181.exe

pid	process
1484	01163923245424584181.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\ProgramData\01163923245424584181.exe	upx
C:\ProgramData\01163923245424584181.exe	upx
behavioral2/memory/1484-161-0x0000000000890000-0x000000000107B000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Set_Yuki_x64.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Set_Yuki_x64.exe

Loads dropped DLL 2 IoCs

Processes:

Set_Yuki_x64.exe

pid process

4364 Set_Yuki_x64.exe
4364 Set_Yuki_x64.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
4364	Set_Yuki_x64.exe
4364	Set_Yuki_x64.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Set_Yuki_x64.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Set_Yuki_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Set_Yuki_x64.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4668 timeout.exe
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 36 Go-http-client/1.1
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Set_Yuki_x64.exe

pid process

4364 Set_Yuki_x64.exe
4364 Set_Yuki_x64.exe

pid	process
4668	timeout.exe

description	flow	ioc
HTTP User-Agent header	36	Go-http-client/1.1

pid	process
4364	Set_Yuki_x64.exe
4364	Set_Yuki_x64.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Set_Yuki_x64.execmd.exe

description	pid	process	target process
PID 4364 wrote to memory of 1484	4364	Set_Yuki_x64.exe	01163923245424584181.exe
PID 4364 wrote to memory of 1484	4364	Set_Yuki_x64.exe	01163923245424584181.exe
PID 4364 wrote to memory of 3104	4364	Set_Yuki_x64.exe	cmd.exe
PID 4364 wrote to memory of 3104	4364	Set_Yuki_x64.exe	cmd.exe
PID 4364 wrote to memory of 3104	4364	Set_Yuki_x64.exe	cmd.exe
PID 3104 wrote to memory of 4668	3104	cmd.exe	timeout.exe
PID 3104 wrote to memory of 4668	3104	cmd.exe	timeout.exe
PID 3104 wrote to memory of 4668	3104	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\Set_Yuki_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Set_Yuki_x64.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4364

C:\ProgramData\01163923245424584181.exe
"C:\ProgramData\01163923245424584181.exe"
2⤵
- Executes dropped EXE
PID:1484

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Set_Yuki_x64.exe" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3104

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
3⤵
- Delays execution with timeout.exe
PID:4668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\01163923245424584181.exe
Filesize
2.8MB

MD5
4a123c0fa6f2d458997a8d92d6ace7ae

SHA1
dc83bde87f0af8412c0784abf4a89ee4ad873427

SHA256
2d360d6c5d5036729a10bb2221630f380cad96e9f7c78b257e086cb26d975a44

SHA512
67c655625d319e3626735dfe6c6b1241fbdcd44b7da3d9342ff1f876c08ab8c9314adae08c403a15d55a71cc0d10c0c05f5b345bcba491325f6799615ef55f35

Download Submit
C:\ProgramData\01163923245424584181.exe
Filesize
2.8MB

MD5
4a123c0fa6f2d458997a8d92d6ace7ae

SHA1
dc83bde87f0af8412c0784abf4a89ee4ad873427

SHA256
2d360d6c5d5036729a10bb2221630f380cad96e9f7c78b257e086cb26d975a44

SHA512
67c655625d319e3626735dfe6c6b1241fbdcd44b7da3d9342ff1f876c08ab8c9314adae08c403a15d55a71cc0d10c0c05f5b345bcba491325f6799615ef55f35

Download Submit
C:\ProgramData\mozglue.dll
Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll
Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
memory/1484-156-0x0000000000000000-mapping.dmp

Download
memory/1484-161-0x0000000000890000-0x000000000107B000-memory.dmp

Filesize
7.9MB

Download
memory/3104-159-0x0000000000000000-mapping.dmp

Download
memory/4364-132-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Filesize
384KB

Download
memory/4364-136-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4668-160-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads