vidar | 0241d42cb4f359df2c67f35b03019c1fa59b72507d49f5cb83cd8b1dffbd8850

General

Target

336ecdd5f5c040f5d3fa238ae4b4813ebc48401500d2dfad0604fa9f.exe
Size

3.8MB
MD5

03e6a233c9bf8b86d7d7fe3a046ef507
SHA1

63a993cfeba3beab665f8518e2a9d5945edadfe4
SHA256

0241d42cb4f359df2c67f35b03019c1fa59b72507d49f5cb83cd8b1dffbd8850
SHA512

7911d620ea29738c3dc2e353faf1253f4100e20b6d1cf326ccfdb2741d45778daa31387f94e86882aa367efa535610ac892c7e3e0cdf7645d5a5585d26059b63
SSDEEP

24576:8yPRZPjShIghUnYbXCdK+umvEragNhB5p/URnO6VAIMYs:80jS+gi4CdyTPXp/URdAzYs

Score

10^/10

vidar fad4e06e1cf15b4775e72bc1a12d0e25 spyware stealer

Malware Config

Extracted

Family

vidar

Version

6

Botnet

fad4e06e1cf15b4775e72bc1a12d0e25

C2

https://steamcommunity.com/profiles/76561199560322242

https://t.me/cahalgo

Attributes

profile_id_v2
fad4e06e1cf15b4775e72bc1a12d0e25
user_agent
Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 uacq

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Loads dropped DLL 2 IoCs

pid	Process
2588	jsc.exe
2588	jsc.exe

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2188 set thread context of 2588	2188	336ecdd5f5c040f5d3fa238ae4b4813ebc48401500d2dfad0604fa9f.exe	30

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	jsc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	jsc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2588	jsc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	336ecdd5f5c040f5d3fa238ae4b4813ebc48401500d2dfad0604fa9f.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2588	2188	336ecdd5f5c040f5d3fa238ae4b4813ebc48401500d2dfad0604fa9f.exe	30
PID 2188 wrote to memory of 2588	2188	336ecdd5f5c040f5d3fa238ae4b4813ebc48401500d2dfad0604fa9f.exe	30
PID 2188 wrote to memory of 2588	2188	336ecdd5f5c040f5d3fa238ae4b4813ebc48401500d2dfad0604fa9f.exe	30
PID 2188 wrote to memory of 2588	2188	336ecdd5f5c040f5d3fa238ae4b4813ebc48401500d2dfad0604fa9f.exe	30
PID 2188 wrote to memory of 2588	2188	336ecdd5f5c040f5d3fa238ae4b4813ebc48401500d2dfad0604fa9f.exe	30
PID 2188 wrote to memory of 2588	2188	336ecdd5f5c040f5d3fa238ae4b4813ebc48401500d2dfad0604fa9f.exe	30
PID 2188 wrote to memory of 2588	2188	336ecdd5f5c040f5d3fa238ae4b4813ebc48401500d2dfad0604fa9f.exe	30
PID 2188 wrote to memory of 2588	2188	336ecdd5f5c040f5d3fa238ae4b4813ebc48401500d2dfad0604fa9f.exe	30
PID 2188 wrote to memory of 2588	2188	336ecdd5f5c040f5d3fa238ae4b4813ebc48401500d2dfad0604fa9f.exe	30
PID 2188 wrote to memory of 2588	2188	336ecdd5f5c040f5d3fa238ae4b4813ebc48401500d2dfad0604fa9f.exe	30

C:\Users\Admin\AppData\Local\Temp\336ecdd5f5c040f5d3fa238ae4b4813ebc48401500d2dfad0604fa9f.exe
"C:\Users\Admin\AppData\Local\Temp\336ecdd5f5c040f5d3fa238ae4b4813ebc48401500d2dfad0604fa9f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabCA15.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD30D.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
memory/2188-29-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/2188-42-0x0000000074D90000-0x000000007547E000-memory.dmp

Filesize
6.9MB

Download
memory/2188-6-0x0000000000740000-0x0000000000755000-memory.dmp

Filesize
84KB

Download
memory/2188-8-0x0000000000740000-0x0000000000755000-memory.dmp

Filesize
84KB

Download
memory/2188-12-0x0000000000740000-0x0000000000755000-memory.dmp

Filesize
84KB

Download
memory/2188-10-0x0000000000740000-0x0000000000755000-memory.dmp

Filesize
84KB

Download
memory/2188-16-0x0000000000740000-0x0000000000755000-memory.dmp

Filesize
84KB

Download
memory/2188-14-0x0000000000740000-0x0000000000755000-memory.dmp

Filesize
84KB

Download
memory/2188-20-0x0000000000740000-0x0000000000755000-memory.dmp

Filesize
84KB

Download
memory/2188-18-0x0000000000740000-0x0000000000755000-memory.dmp

Filesize
84KB

Download
memory/2188-24-0x0000000000740000-0x0000000000755000-memory.dmp

Filesize
84KB

Download
memory/2188-22-0x0000000000740000-0x0000000000755000-memory.dmp

Filesize
84KB

Download
memory/2188-26-0x0000000000740000-0x0000000000755000-memory.dmp

Filesize
84KB

Download
memory/2188-28-0x0000000000740000-0x0000000000755000-memory.dmp

Filesize
84KB

Download
memory/2188-0-0x0000000074D90000-0x000000007547E000-memory.dmp

Filesize
6.9MB

Download
memory/2188-1-0x00000000009A0000-0x0000000000D6C000-memory.dmp

Filesize
3.8MB

Download
memory/2188-2-0x0000000074D90000-0x000000007547E000-memory.dmp

Filesize
6.9MB

Download
memory/2188-3-0x0000000002380000-0x00000000023C0000-memory.dmp

Filesize
256KB

Download
memory/2188-4-0x0000000000740000-0x000000000075C000-memory.dmp

Filesize
112KB

Download
memory/2188-5-0x0000000000740000-0x0000000000755000-memory.dmp

Filesize
84KB

Download
memory/2188-40-0x0000000002380000-0x00000000023C0000-memory.dmp

Filesize
256KB

Download
memory/2588-33-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2588-39-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2588-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2588-41-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2588-34-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2588-43-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2588-37-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2588-32-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2588-91-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2588-31-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2588-30-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2588-128-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2588-129-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download

Analysis

Sharing