vidar | 3b51460702df54688fa2aff8d0b63eb5c254ef4c9bae60a77b3e3e52dc4d4272

General

Target

retry.exe
Size

4.9MB
MD5

c389da5b9644e11abe5b1a802381cc82
SHA1

5f2ac10928dd6efaac04d170f6e69dbb37dd05b9
SHA256

3b51460702df54688fa2aff8d0b63eb5c254ef4c9bae60a77b3e3e52dc4d4272
SHA512

80e7f633f9d0cfe02bd7c45bef4d494afbe7f6aaf8f04d4940968446f62e1f4727ff0a2ae7c91d56be852d92c30ca5535b77ea8148f78a57aac9a2bb4de8bcb4
SSDEEP

98304:df11Mp99eqkpfg2kDUeQH4fN1DuieoYOv8K:/1MpbJkOzQH4f7p

Score

10^/10

vidar 0045e8577d0df745e80e2964a6672412 spyware stealer

Malware Config

Extracted

Family

vidar

Version

5.9

Botnet

0045e8577d0df745e80e2964a6672412

C2

https://steamcommunity.com/profiles/76561199557479327

https://t.me/grizmons

Attributes

profile_id_v2
0045e8577d0df745e80e2964a6672412
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 OPR/104.0.0.0

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Loads dropped DLL 3 IoCs

pid	Process
2972	retry.exe
2700	MsBuild.exe
2700	MsBuild.exe

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2972 set thread context of 2700	2972	retry.exe	28

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MsBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MsBuild.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2700	MsBuild.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2700	2972	retry.exe	28
PID 2972 wrote to memory of 2700	2972	retry.exe	28
PID 2972 wrote to memory of 2700	2972	retry.exe	28
PID 2972 wrote to memory of 2700	2972	retry.exe	28
PID 2972 wrote to memory of 2700	2972	retry.exe	28
PID 2972 wrote to memory of 2700	2972	retry.exe	28
PID 2972 wrote to memory of 2700	2972	retry.exe	28
PID 2972 wrote to memory of 2700	2972	retry.exe	28
PID 2972 wrote to memory of 2700	2972	retry.exe	28
PID 2972 wrote to memory of 2700	2972	retry.exe	28

C:\Users\Admin\AppData\Local\Temp\retry.exe
"C:\Users\Admin\AppData\Local\Temp\retry.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab67AB.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar67EC.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/2700-32-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2700-21-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2700-118-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2700-119-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2700-81-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2700-33-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2700-29-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2700-28-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2700-27-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2700-25-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2700-23-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2700-19-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2972-15-0x0000000005730000-0x0000000005830000-memory.dmp

Filesize
1024KB

Download
memory/2972-0-0x0000000001060000-0x000000000154A000-memory.dmp

Filesize
4.9MB

Download
memory/2972-17-0x0000000005050000-0x0000000005090000-memory.dmp

Filesize
256KB

Download
memory/2972-16-0x0000000005050000-0x0000000005090000-memory.dmp

Filesize
256KB

Download
memory/2972-9-0x0000000005050000-0x0000000005090000-memory.dmp

Filesize
256KB

Download
memory/2972-14-0x0000000005050000-0x0000000005090000-memory.dmp

Filesize
256KB

Download
memory/2972-31-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/2972-18-0x0000000005050000-0x0000000005090000-memory.dmp

Filesize
256KB

Download
memory/2972-12-0x0000000005050000-0x0000000005090000-memory.dmp

Filesize
256KB

Download
memory/2972-8-0x0000000005050000-0x0000000005090000-memory.dmp

Filesize
256KB

Download
memory/2972-3-0x0000000005370000-0x0000000005502000-memory.dmp

Filesize
1.6MB

Download
memory/2972-13-0x0000000005050000-0x0000000005090000-memory.dmp

Filesize
256KB

Download
memory/2972-2-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/2972-1-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/2972-11-0x0000000005050000-0x0000000005090000-memory.dmp

Filesize
256KB

Download
memory/2972-10-0x0000000000430000-0x0000000000440000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing