Resubmissions
11-12-2024 17:42
241211-v97eaaspes 1011-12-2024 17:40
241211-v9bbvaxleq 1001-10-2024 21:39
241001-1h1ejs1hkq 1029-08-2024 12:54
240829-p5n49avaqp 1017-08-2024 17:42
240817-v94y6a1cqp 1017-08-2024 09:57
240817-ly41casgkj 10Analysis
-
max time kernel
58s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2024 21:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
66bddfcb52736_vidar.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
66bddfcb52736_vidar.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
66bddfcb52736_vidar.exe
-
Size
190KB
-
MD5
fedb687ed23f77925b35623027f799bb
-
SHA1
7f27d0290ecc2c81bf2b2d0fa1026f54fd687c81
-
SHA256
325396d5ffca8546730b9a56c2d0ed99238d48b5e1c3c49e7d027505ea13b8d1
-
SHA512
6d1fa39560f4d7ca57905bc57d615acf96b1ef69ca2a4d7c0353278e8d4466298ed87f514463c49d671cb0e3b6a269a78636a10a1e463dba5c83fe067dc5df18
-
SSDEEP
3072:XqsEJybpRHuJKKBardRei4UGvI96/ZO6RAkeOCeP9sZy28se:XqsMyNRHuKikUi42KZO6PffmZy2d
Malware Config
Extracted
Family
vidar
Version
10.7
Botnet
877956da9963e0825aa43a159a358f24
C2
https://steamcommunity.com/profiles/76561199751190313
https://t.me/pech0nk
Attributes
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Signatures
-
Detect Vidar Stealer 5 IoCs
resource yara_rule behavioral2/memory/2104-4-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral2/memory/2104-10-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral2/memory/2104-8-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral2/memory/2104-13-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral2/memory/2104-14-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3628 set thread context of 2104 3628 66bddfcb52736_vidar.exe 82 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66bddfcb52736_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3324 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2104 RegAsm.exe 2104 RegAsm.exe 2104 RegAsm.exe 2104 RegAsm.exe 2104 RegAsm.exe 2104 RegAsm.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3056 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3056 taskmgr.exe Token: SeSystemProfilePrivilege 3056 taskmgr.exe Token: SeCreateGlobalPrivilege 3056 taskmgr.exe Token: 33 3056 taskmgr.exe Token: SeIncBasePriorityPrivilege 3056 taskmgr.exe -
Suspicious use of FindShellTrayWindow 61 IoCs
pid Process 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe -
Suspicious use of SendNotifyMessage 60 IoCs
pid Process 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3628 wrote to memory of 2104 3628 66bddfcb52736_vidar.exe 82 PID 3628 wrote to memory of 2104 3628 66bddfcb52736_vidar.exe 82 PID 3628 wrote to memory of 2104 3628 66bddfcb52736_vidar.exe 82 PID 3628 wrote to memory of 2104 3628 66bddfcb52736_vidar.exe 82 PID 3628 wrote to memory of 2104 3628 66bddfcb52736_vidar.exe 82 PID 3628 wrote to memory of 2104 3628 66bddfcb52736_vidar.exe 82 PID 3628 wrote to memory of 2104 3628 66bddfcb52736_vidar.exe 82 PID 3628 wrote to memory of 2104 3628 66bddfcb52736_vidar.exe 82 PID 3628 wrote to memory of 2104 3628 66bddfcb52736_vidar.exe 82 PID 3628 wrote to memory of 2104 3628 66bddfcb52736_vidar.exe 82 PID 2104 wrote to memory of 3576 2104 RegAsm.exe 85 PID 2104 wrote to memory of 3576 2104 RegAsm.exe 85 PID 2104 wrote to memory of 3576 2104 RegAsm.exe 85 PID 3576 wrote to memory of 3324 3576 cmd.exe 87 PID 3576 wrote to memory of 3324 3576 cmd.exe 87 PID 3576 wrote to memory of 3324 3576 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\66bddfcb52736_vidar.exe"C:\Users\Admin\AppData\Local\Temp\66bddfcb52736_vidar.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & rd /s /q "C:\ProgramData\ECAEGHIJEHJD" & exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3324
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3056
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
PID:1028
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c