vidar | 2f626154e982310a3efc265a8c279dea6c857dac99a96ae698cd797f9dcac174

General

Target

AppSetup.exe
Size

689.2MB
MD5

51546cad54042b12982cd15f8685dacd
SHA1

1d6d6125139e18d76945732d69d833d915da1a8f
SHA256

fecd31d990a942e012bcb6860cc0f76ce46daaaf7d829d0c08f5972878899ffa
SHA512

a0a922f1a62b24cd3c3383c610cbec4eb0ecd3a595f137650466d0f882b89809eb851505221ceff923a7cd6e2500c48d2e7c4bd52441463b9e5ab4a9f290cf94
SSDEEP

98304:TSWU64N6ik/INEdXihZur3ui/xFKtL7UHfrPlkrAUzXGqb1MTmLgx0ZvSeK+YNmG:T4kQNEdyhq4GHTloxgE1Rs

Score

10^/10

vidar 754 bootkit evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

vidar

Version

2.2

Botnet

754

C2

https://t.me/litlebey

https://steamcommunity.com/profiles/76561199472399815

Attributes

profile_id
754

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

AppSetup.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ AppSetup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	AppSetup.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AppSetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AppSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AppSetup.exe

Loads dropped DLL 2 IoCs

Processes:

InstallUtil.exe

pid process

1988 InstallUtil.exe
1988 InstallUtil.exe
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

AppSetup.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA AppSetup.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

AppSetup.exe

description ioc process

File opened for modification \??\PhysicalDrive0 AppSetup.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

AppSetup.exe

pid process

856 AppSetup.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

AppSetup.exe

description pid process target process

PID 856 set thread context of 1988 856 AppSetup.exe InstallUtil.exe

pid	process
1988	InstallUtil.exe
1988	InstallUtil.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AppSetup.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	AppSetup.exe

pid	process
856	AppSetup.exe

description	pid	process	target process
PID 856 set thread context of 1988	856	AppSetup.exe	InstallUtil.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

InstallUtil.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallUtil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallUtil.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1268 timeout.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

InstallUtil.exe

pid process

1988 InstallUtil.exe

pid	process
1268	timeout.exe

pid	process
1988	InstallUtil.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

AppSetup.exeInstallUtil.execmd.exe

description	pid	process	target process
PID 856 wrote to memory of 1988	856	AppSetup.exe	InstallUtil.exe
PID 856 wrote to memory of 1988	856	AppSetup.exe	InstallUtil.exe
PID 856 wrote to memory of 1988	856	AppSetup.exe	InstallUtil.exe
PID 856 wrote to memory of 1988	856	AppSetup.exe	InstallUtil.exe
PID 856 wrote to memory of 1988	856	AppSetup.exe	InstallUtil.exe
PID 856 wrote to memory of 1988	856	AppSetup.exe	InstallUtil.exe
PID 856 wrote to memory of 1988	856	AppSetup.exe	InstallUtil.exe
PID 856 wrote to memory of 1988	856	AppSetup.exe	InstallUtil.exe
PID 856 wrote to memory of 1988	856	AppSetup.exe	InstallUtil.exe
PID 856 wrote to memory of 1988	856	AppSetup.exe	InstallUtil.exe
PID 856 wrote to memory of 1988	856	AppSetup.exe	InstallUtil.exe
PID 856 wrote to memory of 1988	856	AppSetup.exe	InstallUtil.exe
PID 856 wrote to memory of 1988	856	AppSetup.exe	InstallUtil.exe
PID 1988 wrote to memory of 964	1988	InstallUtil.exe	cmd.exe
PID 1988 wrote to memory of 964	1988	InstallUtil.exe	cmd.exe
PID 1988 wrote to memory of 964	1988	InstallUtil.exe	cmd.exe
PID 1988 wrote to memory of 964	1988	InstallUtil.exe	cmd.exe
PID 964 wrote to memory of 1268	964	cmd.exe	timeout.exe
PID 964 wrote to memory of 1268	964	cmd.exe	timeout.exe
PID 964 wrote to memory of 1268	964	cmd.exe	timeout.exe
PID 964 wrote to memory of 1268	964	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\AppSetup.exe
"C:\Users\Admin\AppData\Local\Temp\AppSetup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
4⤵
- Delays execution with timeout.exe
PID:1268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\mozglue.dll
Filesize
133KB

MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll
Filesize
1.2MB

MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
memory/856-66-0x00000000778E0000-0x0000000077A89000-memory.dmp

Filesize
1.7MB

Download
memory/856-58-0x0000000000200000-0x0000000001172000-memory.dmp

Filesize
15.4MB

Download
memory/856-59-0x00000000034B0000-0x0000000003548000-memory.dmp

Filesize
608KB

Download
memory/856-64-0x0000000000200000-0x0000000001172000-memory.dmp

Filesize
15.4MB

Download
memory/856-56-0x0000000000200000-0x0000000001172000-memory.dmp

Filesize
15.4MB

Download
memory/856-57-0x00000000778E0000-0x0000000077A89000-memory.dmp

Filesize
1.7MB

Download
memory/964-89-0x0000000000000000-mapping.dmp

Download
memory/1268-91-0x0000000000000000-mapping.dmp

Download
memory/1988-63-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1988-68-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/1988-67-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1988-65-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1988-61-0x000000000042D1BC-mapping.dmp

Download
memory/1988-90-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1988-60-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads