vidar | 6af280a34b9d478a0f56433f5a00bbb64a98eaea2d63bb257593587c069e9a6c

General

Target

d1d9dcd9c5798957c8e931559c380e9c.exe
Size

1.9MB
MD5

d1d9dcd9c5798957c8e931559c380e9c
SHA1

d1a0d99a3628e3a2f68041b944bdfc9d8fc2cca7
SHA256

6af280a34b9d478a0f56433f5a00bbb64a98eaea2d63bb257593587c069e9a6c
SHA512

abebc00f3a7f317d6970ad76b6a3e03fe68d5fec7c7594b9db91e3ebe7bca464cb53a40b3e74f96592e483c995f2bab06921d081ceb08e26c7e4e6dfebd4ce15
SSDEEP

24576:yruWiJGT33cFU1XcRihl5GLwDsCT6xkaafxCB1Nq3+qkdtBfSRQkjRuDz9:mfDMFUZwiLgLWTAne3AtBfSPjRs

Score

10^/10

vidar 539 discovery evasion spyware stealer

Malware Config

Extracted

Family

vidar

Version

16.6

Botnet

539

C2

http://barkeoikeilo.click/

Attributes

profile_id
539

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

d1d9dcd9c5798957c8e931559c380e9c.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ d1d9dcd9c5798957c8e931559c380e9c.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d1d9dcd9c5798957c8e931559c380e9c.exe

Vidar Stealer 17 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2492-15-0x0000000000400000-0x00000000008BB000-memory.dmp	family_vidar
behavioral1/memory/2492-34-0x0000000000400000-0x00000000008BB000-memory.dmp	family_vidar
behavioral1/memory/2492-35-0x0000000000400000-0x00000000008BB000-memory.dmp	family_vidar
behavioral1/memory/2492-36-0x0000000000400000-0x00000000008BB000-memory.dmp	family_vidar
behavioral1/memory/2492-37-0x0000000000400000-0x00000000008BB000-memory.dmp	family_vidar
behavioral1/memory/2492-38-0x0000000000400000-0x00000000008BB000-memory.dmp	family_vidar
behavioral1/memory/2492-39-0x0000000000400000-0x00000000008BB000-memory.dmp	family_vidar
behavioral1/memory/2492-40-0x0000000000400000-0x00000000008BB000-memory.dmp	family_vidar
behavioral1/memory/2492-41-0x0000000000400000-0x00000000008BB000-memory.dmp	family_vidar
behavioral1/memory/2492-42-0x0000000000400000-0x00000000008BB000-memory.dmp	family_vidar
behavioral1/memory/2492-43-0x0000000000400000-0x00000000008BB000-memory.dmp	family_vidar
behavioral1/memory/2492-46-0x0000000000400000-0x00000000008BB000-memory.dmp	family_vidar
behavioral1/memory/2492-47-0x0000000000400000-0x00000000008BB000-memory.dmp	family_vidar
behavioral1/memory/2492-48-0x0000000000400000-0x00000000008BB000-memory.dmp	family_vidar
behavioral1/memory/2492-49-0x0000000000400000-0x00000000008BB000-memory.dmp	family_vidar
behavioral1/memory/2492-50-0x0000000000400000-0x00000000008BB000-memory.dmp	family_vidar
behavioral1/memory/2492-51-0x0000000000400000-0x00000000008BB000-memory.dmp	family_vidar

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d1d9dcd9c5798957c8e931559c380e9c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d1d9dcd9c5798957c8e931559c380e9c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d1d9dcd9c5798957c8e931559c380e9c.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

d1d9dcd9c5798957c8e931559c380e9c.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Wine d1d9dcd9c5798957c8e931559c380e9c.exe
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

d1d9dcd9c5798957c8e931559c380e9c.exe

pid process

2492 d1d9dcd9c5798957c8e931559c380e9c.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Wine	d1d9dcd9c5798957c8e931559c380e9c.exe

flow	ioc
6	ip-api.com

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d1d9dcd9c5798957c8e931559c380e9c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	d1d9dcd9c5798957c8e931559c380e9c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d1d9dcd9c5798957c8e931559c380e9c.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

d1d9dcd9c5798957c8e931559c380e9c.exe

pid	process
2492	d1d9dcd9c5798957c8e931559c380e9c.exe
2492	d1d9dcd9c5798957c8e931559c380e9c.exe
2492	d1d9dcd9c5798957c8e931559c380e9c.exe
2492	d1d9dcd9c5798957c8e931559c380e9c.exe
2492	d1d9dcd9c5798957c8e931559c380e9c.exe

C:\Users\Admin\AppData\Local\Temp\d1d9dcd9c5798957c8e931559c380e9c.exe
"C:\Users\Admin\AppData\Local\Temp\d1d9dcd9c5798957c8e931559c380e9c.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2492

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

4

T1552.001

Discovery

Query Registry

5

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2492-0-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2492-1-0x0000000077640000-0x0000000077642000-memory.dmp

Filesize
8KB

Download
memory/2492-2-0x00000000043E0000-0x00000000043E1000-memory.dmp

Filesize
4KB

Download
memory/2492-3-0x0000000004430000-0x0000000004431000-memory.dmp

Filesize
4KB

Download
memory/2492-5-0x0000000004460000-0x0000000004461000-memory.dmp

Filesize
4KB

Download
memory/2492-4-0x00000000044A0000-0x00000000044A1000-memory.dmp

Filesize
4KB

Download
memory/2492-6-0x0000000004490000-0x0000000004491000-memory.dmp

Filesize
4KB

Download
memory/2492-7-0x00000000043B0000-0x00000000043B2000-memory.dmp

Filesize
8KB

Download
memory/2492-8-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/2492-9-0x00000000044B0000-0x00000000044B1000-memory.dmp

Filesize
4KB

Download
memory/2492-10-0x0000000004450000-0x0000000004451000-memory.dmp

Filesize
4KB

Download
memory/2492-14-0x00000000043C0000-0x00000000043C1000-memory.dmp

Filesize
4KB

Download
memory/2492-13-0x0000000004480000-0x0000000004481000-memory.dmp

Filesize
4KB

Download
memory/2492-12-0x0000000004470000-0x0000000004471000-memory.dmp

Filesize
4KB

Download
memory/2492-11-0x0000000004370000-0x0000000004371000-memory.dmp

Filesize
4KB

Download
memory/2492-15-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2492-17-0x00000000044D0000-0x00000000044D1000-memory.dmp

Filesize
4KB

Download
memory/2492-18-0x0000000004440000-0x0000000004441000-memory.dmp

Filesize
4KB

Download
memory/2492-16-0x00000000044E0000-0x00000000044E1000-memory.dmp

Filesize
4KB

Download
memory/2492-19-0x00000000043F0000-0x00000000043F1000-memory.dmp

Filesize
4KB

Download
memory/2492-20-0x0000000004420000-0x0000000004422000-memory.dmp

Filesize
8KB

Download
memory/2492-25-0x00000000043D0000-0x00000000043D1000-memory.dmp

Filesize
4KB

Download
memory/2492-24-0x0000000004390000-0x0000000004391000-memory.dmp

Filesize
4KB

Download
memory/2492-23-0x00000000043A0000-0x00000000043A1000-memory.dmp

Filesize
4KB

Download
memory/2492-26-0x0000000004400000-0x0000000004401000-memory.dmp

Filesize
4KB

Download
memory/2492-27-0x0000000004380000-0x0000000004381000-memory.dmp

Filesize
4KB

Download
memory/2492-28-0x0000000004410000-0x0000000004411000-memory.dmp

Filesize
4KB

Download
memory/2492-34-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2492-35-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2492-36-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2492-37-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2492-38-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2492-39-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2492-40-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2492-41-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2492-42-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2492-43-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2492-46-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2492-47-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2492-48-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2492-49-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2492-50-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2492-51-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads