vidar | de49d99aca6f263329701def3789f4844cec7b66eada3ecdfc122d91a061beed

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 06:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mkhg_regogo.exe
Size

1.2MB
MD5

1f65e4a559b6ca5bca255e34914d2a16
SHA1

35177abc3c3b2d8bde1e5fb5b91223d9f9a80d96
SHA256

de49d99aca6f263329701def3789f4844cec7b66eada3ecdfc122d91a061beed
SHA512

44c0560fd0fb995a07a4bda63bdc45184048c42038cd79a314949640353951862c511cdd8ff7f1b0c4c7bc1fce677124f9ef6c289893c0c534f65737aaf1cd8c
SSDEEP

12288:aG3LBPOWjgduS18IFGL55r8eHwN6hKNCoJn1jZMPBP6IVmtQFLkw8tBKyp/DH2DS:hBry8IFQL8x8C1QOw8tBJtHaSlYITb26

Score

10^/10

vidar ae7206f995af44407705655c590dd082 stealer

Malware Config

Extracted

Family

vidar

Version

5.6

Botnet

ae7206f995af44407705655c590dd082

https://steamcommunity.com/profiles/76561199550790047

https://t.me/bonoboaz

Attributes

profile_id_v2
ae7206f995af44407705655c590dd082
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 OPR/103.0.0.0

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

mkhg_regogo.exe

description pid process target process

PID 4180 created 3204 4180 mkhg_regogo.exe Explorer.EXE
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Executes dropped EXE 1 IoCs

Processes:

VBoxSVC.exe

pid process

2768 VBoxSVC.exe
Loads dropped DLL 5 IoCs

Processes:

VBoxSVC.exe

pid process

2768 VBoxSVC.exe
2768 VBoxSVC.exe
2768 VBoxSVC.exe
2768 VBoxSVC.exe
2768 VBoxSVC.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

VBoxSVC.exe

description pid process target process

PID 2768 set thread context of 628 2768 VBoxSVC.exe cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

mkhg_regogo.exeVBoxSVC.execmd.exe

pid process

4180 mkhg_regogo.exe
4180 mkhg_regogo.exe
2768 VBoxSVC.exe
628 cmd.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

VBoxSVC.execmd.exe

pid process

2768 VBoxSVC.exe
628 cmd.exe

description	pid	process	target process
PID 4180 created 3204	4180	mkhg_regogo.exe	Explorer.EXE

pid	process
2768	VBoxSVC.exe

pid	process
2768	VBoxSVC.exe
2768	VBoxSVC.exe
2768	VBoxSVC.exe
2768	VBoxSVC.exe
2768	VBoxSVC.exe

description	pid	process	target process
PID 2768 set thread context of 628	2768	VBoxSVC.exe	cmd.exe

pid	process
4180	mkhg_regogo.exe
4180	mkhg_regogo.exe
2768	VBoxSVC.exe
628	cmd.exe

pid	process
2768	VBoxSVC.exe
628	cmd.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

mkhg_regogo.exeVBoxSVC.execmd.exe

description	pid	process	target process
PID 4180 wrote to memory of 2768	4180	mkhg_regogo.exe	VBoxSVC.exe
PID 4180 wrote to memory of 2768	4180	mkhg_regogo.exe	VBoxSVC.exe
PID 2768 wrote to memory of 628	2768	VBoxSVC.exe	cmd.exe
PID 2768 wrote to memory of 628	2768	VBoxSVC.exe	cmd.exe
PID 2768 wrote to memory of 628	2768	VBoxSVC.exe	cmd.exe
PID 2768 wrote to memory of 628	2768	VBoxSVC.exe	cmd.exe
PID 628 wrote to memory of 3300	628	cmd.exe	explorer.exe
PID 628 wrote to memory of 3300	628	cmd.exe	explorer.exe
PID 628 wrote to memory of 3300	628	cmd.exe	explorer.exe
PID 628 wrote to memory of 3300	628	cmd.exe	explorer.exe
PID 628 wrote to memory of 3300	628	cmd.exe	explorer.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3204
- C:\Users\Admin\AppData\Local\Temp\mkhg_regogo.exe
  "C:\Users\Admin\AppData\Local\Temp\mkhg_regogo.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4180
- C:\Users\Admin\AppData\Roaming\mfplat\VBoxSVC.exe
  C:\Users\Admin\AppData\Roaming\mfplat\VBoxSVC.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      PID:3300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2ed3cfa1

Filesize
748KB

MD5
5ebdb098232dea3da2ad62bada6dda28

SHA1
da77023a5ef6d9e0f4f6419150644e30c44b8914

SHA256
26bd401d7639e1c68c6e95496743c178e3f93428b922d4c73903eb5474c7ca47

SHA512
ff0e8ffb65ce65417fdeaab40cd1ea362fde5e6fcfa5bda2d806e57a079bd2f8f9f2fe508c1d1e71462143a121163536f21093f5ef89270b9a2824db7ebf8af9

Download Submit
C:\Users\Admin\AppData\Roaming\mfplat\MSVCP100.dll

Filesize
593KB

MD5
d029339c0f59cf662094eddf8c42b2b5

SHA1
a0b6de44255ce7bfade9a5b559dd04f2972bfdc8

SHA256
934d882efd3c0f3f1efbc238ef87708f3879f5bb456d30af62f3368d58b6aa4c

SHA512
021d9af52e68cb7a3b0042d9ed6c9418552ee16df966f9ccedd458567c47d70471cb8851a69d3982d64571369664faeeae3be90e2e88a909005b9cdb73679c82

Download Submit
C:\Users\Admin\AppData\Roaming\mfplat\MSVCR100.dll

Filesize
809KB

MD5
366fd6f3a451351b5df2d7c4ecf4c73a

SHA1
50db750522b9630757f91b53df377fd4ed4e2d66

SHA256
ae3cb6c6afba9a4aa5c85f66023c35338ca579b30326dd02918f9d55259503d5

SHA512
2de764772b68a85204b7435c87e9409d753c2196cf5b2f46e7796c99a33943e167f62a92e8753eaa184cd81fb14361e83228eb1b474e0c3349ed387ec93e6130

Download Submit
C:\Users\Admin\AppData\Roaming\mfplat\VBoxDDU.dll

Filesize
371KB

MD5
1f70df1ffc9fb711da8eae4d14961df3

SHA1
7950c6d68cf0b1b050421f1c84d77c9b7197804d

SHA256
6efc41aeadafd73155ce3efc477c8968e593578b31a9843a63d9318b4c62c10e

SHA512
d4e077b8cc3d3f5efbc5c42d83d08dc1870d2c6ff1fda5307f24b0f1db7bedfc7216a8b2ec668517f097ea84d63e962441ed7898de3973782b3bf692ae67049a

Download Submit
C:\Users\Admin\AppData\Roaming\mfplat\VBoxDDU.dll

Filesize
371KB

MD5
1f70df1ffc9fb711da8eae4d14961df3

SHA1
7950c6d68cf0b1b050421f1c84d77c9b7197804d

SHA256
6efc41aeadafd73155ce3efc477c8968e593578b31a9843a63d9318b4c62c10e

SHA512
d4e077b8cc3d3f5efbc5c42d83d08dc1870d2c6ff1fda5307f24b0f1db7bedfc7216a8b2ec668517f097ea84d63e962441ed7898de3973782b3bf692ae67049a

Download Submit
C:\Users\Admin\AppData\Roaming\mfplat\VBoxRT.dll

Filesize
4.1MB

MD5
31e7657643d832681fee0e303e25ee52

SHA1
0756c911a602cfe2f094104d1c10a2d014c52e59

SHA256
7328aeb5cec65215e5462c1ea4d69a6383fb77605ccb84c60fdb90d6d0b3c0f4

SHA512
542ecead0a1d54de9300220799b1bbaf5e304fafa95c4ce130f0003a5c693adcf1c3140d67e6721c1cbc576989597bff7353727cec95ac289f563e1aee1ec9c2

Download Submit
C:\Users\Admin\AppData\Roaming\mfplat\VBoxRT.dll

Filesize
4.1MB

MD5
31e7657643d832681fee0e303e25ee52

SHA1
0756c911a602cfe2f094104d1c10a2d014c52e59

SHA256
7328aeb5cec65215e5462c1ea4d69a6383fb77605ccb84c60fdb90d6d0b3c0f4

SHA512
542ecead0a1d54de9300220799b1bbaf5e304fafa95c4ce130f0003a5c693adcf1c3140d67e6721c1cbc576989597bff7353727cec95ac289f563e1aee1ec9c2

Download Submit
C:\Users\Admin\AppData\Roaming\mfplat\VBoxRT.dll

Filesize
4.1MB

MD5
31e7657643d832681fee0e303e25ee52

SHA1
0756c911a602cfe2f094104d1c10a2d014c52e59

SHA256
7328aeb5cec65215e5462c1ea4d69a6383fb77605ccb84c60fdb90d6d0b3c0f4

SHA512
542ecead0a1d54de9300220799b1bbaf5e304fafa95c4ce130f0003a5c693adcf1c3140d67e6721c1cbc576989597bff7353727cec95ac289f563e1aee1ec9c2

Download Submit
C:\Users\Admin\AppData\Roaming\mfplat\VBoxSVC.exe

Filesize
3.4MB

MD5
c8a2de7077f97d4bce1a44317b49ef41

SHA1
6cb3212ec9be08cb5a29bf8d37e9ca845efc18c9

SHA256
448402c129a721812fa1c5f279f5ca906b9c8bbca652a91655d144d20ce5e6b4

SHA512
9815eba1566a8e33734f6a218071ec501dd1f799b1535e25d87c2b416b928ae8d15f8218cf20e685f9907ec39c202cbfc4728fe6ab9d87b3de345109f626845e

Download Submit
C:\Users\Admin\AppData\Roaming\mfplat\VBoxSVC.exe

Filesize
3.4MB

MD5
c8a2de7077f97d4bce1a44317b49ef41

SHA1
6cb3212ec9be08cb5a29bf8d37e9ca845efc18c9

SHA256
448402c129a721812fa1c5f279f5ca906b9c8bbca652a91655d144d20ce5e6b4

SHA512
9815eba1566a8e33734f6a218071ec501dd1f799b1535e25d87c2b416b928ae8d15f8218cf20e685f9907ec39c202cbfc4728fe6ab9d87b3de345109f626845e

Download Submit
C:\Users\Admin\AppData\Roaming\mfplat\antitype.xml

Filesize
619KB

MD5
c770997b0b61a60c9b03824830dc5716

SHA1
478f8d1f387a17a6afe6f54e1510e89b8326fef7

SHA256
b17fe8fc03344dabc2670dc9ac410623c41cad74f596eb43be3508ac8bdabbf4

SHA512
3450971bc8f689d959f4b18edce7d5377224a2886e3247d60636ae30cf6fd437d3778dfeed930269d553ab71fd260dcdbac1332fab7cdf76717b5d1acae47aa5

Download Submit
C:\Users\Admin\AppData\Roaming\mfplat\msvcp100.dll

Filesize
593KB

MD5
d029339c0f59cf662094eddf8c42b2b5

SHA1
a0b6de44255ce7bfade9a5b559dd04f2972bfdc8

SHA256
934d882efd3c0f3f1efbc238ef87708f3879f5bb456d30af62f3368d58b6aa4c

SHA512
021d9af52e68cb7a3b0042d9ed6c9418552ee16df966f9ccedd458567c47d70471cb8851a69d3982d64571369664faeeae3be90e2e88a909005b9cdb73679c82

Download Submit
C:\Users\Admin\AppData\Roaming\mfplat\msvcr100.dll

Filesize
809KB

MD5
366fd6f3a451351b5df2d7c4ecf4c73a

SHA1
50db750522b9630757f91b53df377fd4ed4e2d66

SHA256
ae3cb6c6afba9a4aa5c85f66023c35338ca579b30326dd02918f9d55259503d5

SHA512
2de764772b68a85204b7435c87e9409d753c2196cf5b2f46e7796c99a33943e167f62a92e8753eaa184cd81fb14361e83228eb1b474e0c3349ed387ec93e6130

Download Submit
memory/628-33-0x00000000748E0000-0x0000000075B34000-memory.dmp

Filesize
18.3MB

Download
memory/628-31-0x00000000748E0000-0x0000000075B34000-memory.dmp

Filesize
18.3MB

Download
memory/628-30-0x00000000748E0000-0x0000000075B34000-memory.dmp

Filesize
18.3MB

Download
memory/628-28-0x00007FFA95070000-0x00007FFA95265000-memory.dmp

Filesize
2.0MB

Download
memory/2768-22-0x00007FFA74280000-0x00007FFA758F7000-memory.dmp

Filesize
22.5MB

Download
memory/2768-25-0x00007FFA74280000-0x00007FFA758F7000-memory.dmp

Filesize
22.5MB

Download
memory/2768-23-0x00007FFA74280000-0x00007FFA758F7000-memory.dmp

Filesize
22.5MB

Download
memory/3300-34-0x00007FFA95070000-0x00007FFA95265000-memory.dmp

Filesize
2.0MB

Download
memory/3300-35-0x00000000001E0000-0x0000000000247000-memory.dmp

Filesize
412KB

Download
memory/3300-36-0x00000000001E0000-0x0000000000247000-memory.dmp

Filesize
412KB

Download
memory/3300-38-0x00000000005D0000-0x0000000000A03000-memory.dmp

Filesize
4.2MB

Download
memory/3300-51-0x00000000001E0000-0x0000000000247000-memory.dmp

Filesize
412KB

Download
memory/4180-24-0x0000000074040000-0x0000000075294000-memory.dmp

Filesize
18.3MB

Download
memory/4180-1-0x0000000074040000-0x0000000075294000-memory.dmp

Filesize
18.3MB

Download
memory/4180-20-0x0000000074040000-0x0000000075294000-memory.dmp

Filesize
18.3MB

Download