vidar | c484af9d90f4ee9db8f065be845eb6f47d7281e769e6e35a083790a6d66e4391

Resubmissions

04/09/2023, 06:25

230904-g6zndaeb61

02/09/2023, 20:13

230902-yzsd6afd3t10

Analysis

max time kernel
137s
max time network
275s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2023, 20:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Presentation info/Presentation info.exe
Size 93.2MB
Sample230902-yzsd6afd3t
SHA256 5e374fbc3960dd68c2cef4209851103f5623957e9815a0be720befd7899d3cc0
MD5 e06a97f4714b6d0e62c51b3395a64a6e
SHA1 870e5cc5a18acb41c1377c6a47b4cef76723a2e1
SHA512 b0483408723e5bd786d8170c2b46c25d1f37f2bca9f0f6855c8b94a2acea914dd45a3e479299bd9aeb920d6966667b729e7cbe4a03126945d90e4f33c7169df7
SSDEEP 1572864:UjA+Zh4QkjGuWsqebzyuGqNMnKuEqHhaPd5nC8DDkeZZZZZsOKa1pVeOKCr7ZPo:UjA+P43jRWshbzyuNMnlEqIPrzDkeZZs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar 86277575c381e1fefb9bf290d771e6f1 spyware stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

86277575c381e1fefb9bf290d771e6f1

https://steamcommunity.com/profiles/76561199545993403
http://79.137.206.192:80
https://t.me/vogogor

Attributes

profile_id_v2
86277575c381e1fefb9bf290d771e6f1
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1192 created 3236	1192	Presentation info.exe	18

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Executes dropped EXE 1 IoCs

pid	Process
2132	GUP.exe

Loads dropped DLL 3 IoCs

pid	Process
2132	GUP.exe
3000	explorer.exe
3000	explorer.exe

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2132 set thread context of 3708	2132	GUP.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4808	timeout.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1192	Presentation info.exe
1192	Presentation info.exe
2132	GUP.exe
3708	cmd.exe
3000	explorer.exe
3000	explorer.exe
3000	explorer.exe
3000	explorer.exe
3000	explorer.exe
3000	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2132	GUP.exe
3708	cmd.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2132	1192	Presentation info.exe	86
PID 1192 wrote to memory of 2132	1192	Presentation info.exe	86
PID 2132 wrote to memory of 3708	2132	GUP.exe	87
PID 2132 wrote to memory of 3708	2132	GUP.exe	87
PID 2132 wrote to memory of 3708	2132	GUP.exe	87
PID 2132 wrote to memory of 3708	2132	GUP.exe	87
PID 3708 wrote to memory of 3000	3708	cmd.exe	94
PID 3708 wrote to memory of 3000	3708	cmd.exe	94
PID 3708 wrote to memory of 3000	3708	cmd.exe	94
PID 3708 wrote to memory of 3000	3708	cmd.exe	94
PID 3000 wrote to memory of 4492	3000	explorer.exe	95
PID 3000 wrote to memory of 4492	3000	explorer.exe	95
PID 3000 wrote to memory of 4492	3000	explorer.exe	95
PID 4492 wrote to memory of 4808	4492	cmd.exe	97
PID 4492 wrote to memory of 4808	4492	cmd.exe	97
PID 4492 wrote to memory of 4808	4492	cmd.exe	97

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3236
- C:\Users\Admin\AppData\Local\Temp\Presentation info\Presentation info.exe
  "C:\Users\Admin\AppData\Local\Temp\Presentation info\Presentation info.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1192
- C:\Users\Admin\AppData\Roaming\propsys\GUP.exe
  "C:\Users\Admin\AppData\Roaming\propsys\GUP.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3000
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\SysWOW64\explorer.exe" & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4492
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        6⤵
        Delays execution with timeout.exe
        
        PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

20110b16

Path C:\Users\Admin\AppData\Local\Temp\20110b16
Size 789KB
SHA256 6204eaddd1ff563fc5447e5623f40cca4ce4fee7c5634a7de14d087ffb0c6902
MD5 bc76be427dd97901bc011518f49c97a7
SHA1 2e6024cfc516ceed8f555582972b61fdedea09e6
SHA512 7553a661482fdd62b07813ae214a73d1a309ee618d4eb9faf856c7d04858d535582eabb27d11f6c7ab77c7996e9dcc7b727ab62b1613ed4091c8a90eecbb2e2d
SSDEEP 12288:nCdkCzDiMnNwk0T2i9RJmCRRktfReDM6UbSG455H7XZDY++kiho/SZto8/E:nDCzTn2k0t9RJcLTbe5tDF+hheUtA
MD5 SHA1 SHA512 SSDEEP

Submit Download

GUP.exe

Path C:\Users\Admin\AppData\Roaming\propsys\GUP.exe
Size 954KB
SHA256 ff14c25bf61e359668e0eeadb48345737caebf658f04e5b7ab4d4f465d0fd01c
MD5 4620f1ba5072f37bdedf2650c654595d
SHA1 7f9079445da0b254457917c97945216eab3536ca
SHA512 842a1935e95be85365b24a560c02b6bb9ec424a89c5e4240c28e2c63864da814dd862c5ed32847c5277570bed2cc1f90e94fe23fb5cd9950dbea4de18584313a
SSDEEP 12288:FAhvfYClxFGLZx2v0fVmWCHwX2CsyICH8DDFYcs0+qoS9TTa5W9DP4rv8Dsnm:Fivcx2vFDHkxsyIbxxRTTa5W9DP2kIm
MD5 SHA1 SHA512 SSDEEP

Submit Download

GUP.exe

Path C:\Users\Admin\AppData\Roaming\propsys\GUP.exe
Size 954KB
SHA256 ff14c25bf61e359668e0eeadb48345737caebf658f04e5b7ab4d4f465d0fd01c
MD5 4620f1ba5072f37bdedf2650c654595d
SHA1 7f9079445da0b254457917c97945216eab3536ca
SHA512 842a1935e95be85365b24a560c02b6bb9ec424a89c5e4240c28e2c63864da814dd862c5ed32847c5277570bed2cc1f90e94fe23fb5cd9950dbea4de18584313a
SSDEEP 12288:FAhvfYClxFGLZx2v0fVmWCHwX2CsyICH8DDFYcs0+qoS9TTa5W9DP4rv8Dsnm:Fivcx2vFDHkxsyIbxxRTTa5W9DP2kIm
MD5 SHA1 SHA512 SSDEEP

Submit Download

balletomania.dat

Path C:\Users\Admin\AppData\Roaming\propsys\balletomania.dat
Size 651KB
SHA256 737e82e773583bc00fc6407d47abc670b319d3a30dad26465b3276d39bed8369
MD5 2912f77ed01ce8120a5f2f58c4004461
SHA1 1e1d45e926ca935cc813cdcd44028c6acd410568
SHA512 426023375d76d507c588cef631c4aca1e86ca56109b36eb3c1a71d21180c0d2c0e6ca36b07e7faa099d998dbfa14651de4e5e51107d96632b1505bb8369c3058
SSDEEP 12288:80GOjOM1WnMDhlAx7QeVjA/2M9jpbDz3Tfomk4pk1dIalV/jFx8bnH:80GSOQMMDhyLM/2cjpPz3DoyOHICjFCz
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Roaming\propsys\libcurl.dll
Size 666KB
SHA256 632855381a9e80f6f48bea4011f01f2dfa7a42141fe6eeacc58a27947efee196
MD5 a7d4413b2f10c6e6b1663818547e89d1
SHA1 16ac5f275430722bbb0f208782202b55646451ca
SHA512 a8588dbf67f36b994ae2deb535d27e28d9f747fc1ba4a4303859feb528bedb563775a119f542ce5db1502791fd138eb008b55de29de272a5ca5963ccbe63e5f7
SSDEEP 12288:vTChUrRDjmkqR6tv3cKOuWmDxyEI+mVLIOlwBnq48+MVjk1WIbm:v2bptuWKxyEI+mNIOlenqd+MVwnm
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Roaming\propsys\libcurl.dll
Size 666KB
SHA256 632855381a9e80f6f48bea4011f01f2dfa7a42141fe6eeacc58a27947efee196
MD5 a7d4413b2f10c6e6b1663818547e89d1
SHA1 16ac5f275430722bbb0f208782202b55646451ca
SHA512 a8588dbf67f36b994ae2deb535d27e28d9f747fc1ba4a4303859feb528bedb563775a119f542ce5db1502791fd138eb008b55de29de272a5ca5963ccbe63e5f7
SSDEEP 12288:vTChUrRDjmkqR6tv3cKOuWmDxyEI+mVLIOlwBnq48+MVjk1WIbm:v2bptuWKxyEI+mNIOlenqd+MVwnm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1192-1-0x00007FF800460000-0x00007FF80078D000-memory.dmp

Download

memory/1192-7-0x0000000000400000-0x0000000000634000-memory.dmp

Download

memory/2132-12-0x00007FFFF2020000-0x00007FFFF3697000-memory.dmp

Download

memory/3000-25-0x00000000003D0000-0x0000000000442000-memory.dmp

Download

memory/3000-22-0x00000000003D0000-0x0000000000442000-memory.dmp

Download

memory/3000-23-0x00007FF8114D0000-0x00007FF8116C5000-memory.dmp

Download

memory/3000-27-0x0000000000B90000-0x0000000000FC3000-memory.dmp

Download

memory/3000-28-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/3000-70-0x00000000003D0000-0x0000000000442000-memory.dmp

Download

memory/3708-21-0x0000000073F80000-0x00000000751D4000-memory.dmp

Download

memory/3708-19-0x0000000073F80000-0x00000000751D4000-memory.dmp

Download

memory/3708-18-0x0000000073F80000-0x00000000751D4000-memory.dmp

Download

memory/3708-15-0x00007FF8114D0000-0x00007FF8116C5000-memory.dmp

Download