vidar | bcb04dd0b21bb1bea097a7b8d8f95429c657ce8db622a5c5d3b82f157ab6c6a0

General

Target

Setup.exe
Size

202KB
MD5

64179e64675e822559cac6652298bdfc
SHA1

cceed3b2441146762512918af7bf7f89fb055583
SHA256

c26db97858c427d92e393396f7cb7f9e7ed8f9ce616adcc123d0ec6b055b99c9
SHA512

ef740b35ea5190f8ee47776af1f15ebdd54d39c84da5665e64f67ae6dd0f4b181e955e9a35319a5d0bd764972562e8f2bc44dbdf83c3bedf05674eae902e7280
SSDEEP

3072:EMtKztOp6KfOQqoY3ltdNjlcwsSdplkrxf+Uyecgw:ELKfOQLY3l9jlcwnlUf+z7gw

Score

10^/10

vidar a5215640c3d06b049aee58cc78e4057d discovery stealer

Malware Config

Extracted

Family

vidar

Version

8.3

Botnet

a5215640c3d06b049aee58cc78e4057d

C2

https://78.47.78.87

https://steamcommunity.com/profiles/76561199651834633

https://t.me/raf6ik

Attributes

profile_id_v2
a5215640c3d06b049aee58cc78e4057d
user_agent
Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Signatures

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/memory/2360-27-0x0000000001230000-0x0000000001978000-memory.dmp	family_vidar_v7
behavioral2/memory/2360-29-0x0000000001230000-0x0000000001978000-memory.dmp	family_vidar_v7
behavioral2/memory/2360-30-0x0000000001230000-0x0000000001978000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 220 set thread context of 2308	220	Setup.exe	83

Loads dropped DLL 1 IoCs

pid	Process
2360	GraphicsFillRect.au3

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GraphicsFillRect.au3
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
220	Setup.exe
220	Setup.exe
2308	more.com
2308	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
220	Setup.exe
2308	more.com

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 2308	220	Setup.exe	83
PID 220 wrote to memory of 2308	220	Setup.exe	83
PID 220 wrote to memory of 2308	220	Setup.exe	83
PID 220 wrote to memory of 2308	220	Setup.exe	83
PID 2308 wrote to memory of 2360	2308	more.com	92
PID 2308 wrote to memory of 2360	2308	more.com	92
PID 2308 wrote to memory of 2360	2308	more.com	92
PID 2308 wrote to memory of 2360	2308	more.com	92
PID 2308 wrote to memory of 2360	2308	more.com	92

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\GraphicsFillRect.au3
    C:\Users\Admin\AppData\Local\Temp\GraphicsFillRect.au3
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\189e445a

Filesize
6.8MB

MD5
b710dec84c466be89701206cf8e06397

SHA1
8fc4ec80c95aecd05d756086e4b2382f7bde26fa

SHA256
16fdc1873b959f9b866fb3a3be3ee85244641d3236d42a56bbd85f93bc15d7e0

SHA512
b24b939fc967f6af155e1c760c994e41da10323007e7e4bae1e6579a5b794b626e6514fa6320256c21611fb065d672f7d281dd51e9d29e98617df00363bcbf5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\GraphicsFillRect.au3

Filesize
925KB

MD5
0162a97ed477353bc35776a7addffd5c

SHA1
10db8fe20bbce0f10517c510ec73532cf6feb227

SHA256
15600ccdef5a64b40d206d89234a51be1e11bd878dcefc5986590bcf40d9d571

SHA512
9638cab1aabe78c22a3d3528a391544f697d792640d831516b63fa52c393ee96bb588223e70163d059208cc5a14481c5ff7ef6ba9ac572322798a823d67f01f5

Download Submit
memory/220-0-0x0000000074AE0000-0x0000000074C5B000-memory.dmp

Filesize
1.5MB

Download
memory/220-1-0x00007FFC2E430000-0x00007FFC2E625000-memory.dmp

Filesize
2.0MB

Download
memory/220-10-0x0000000074AF2000-0x0000000074AF3000-memory.dmp

Filesize
4KB

Download
memory/220-11-0x0000000074AE0000-0x0000000074C5B000-memory.dmp

Filesize
1.5MB

Download
memory/220-12-0x0000000074AE0000-0x0000000074C5B000-memory.dmp

Filesize
1.5MB

Download
memory/2308-18-0x0000000074AE0000-0x0000000074C5B000-memory.dmp

Filesize
1.5MB

Download
memory/2308-16-0x00007FFC2E430000-0x00007FFC2E625000-memory.dmp

Filesize
2.0MB

Download
memory/2308-19-0x0000000074AE0000-0x0000000074C5B000-memory.dmp

Filesize
1.5MB

Download
memory/2308-24-0x0000000074AE0000-0x0000000074C5B000-memory.dmp

Filesize
1.5MB

Download
memory/2308-14-0x0000000074AE0000-0x0000000074C5B000-memory.dmp

Filesize
1.5MB

Download
memory/2360-27-0x0000000001230000-0x0000000001978000-memory.dmp

Filesize
7.3MB

Download
memory/2360-28-0x00007FFC2E430000-0x00007FFC2E625000-memory.dmp

Filesize
2.0MB

Download
memory/2360-29-0x0000000001230000-0x0000000001978000-memory.dmp

Filesize
7.3MB

Download
memory/2360-30-0x0000000001230000-0x0000000001978000-memory.dmp

Filesize
7.3MB

Download

Analysis

Sharing