Resubmissions
11-12-2024 17:42
241211-v97eaaspes 1011-12-2024 17:40
241211-v9bbvaxleq 1001-10-2024 21:39
241001-1h1ejs1hkq 1029-08-2024 12:54
240829-p5n49avaqp 1017-08-2024 17:42
240817-v94y6a1cqp 1017-08-2024 09:57
240817-ly41casgkj 10Analysis
-
max time kernel
96s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-12-2024 17:42
Static task
static1
Behavioral task
behavioral1
Sample
66bddfcb52736_vidar.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
66bddfcb52736_vidar.exe
Resource
win10v2004-20241007-en
General
-
Target
66bddfcb52736_vidar.exe
-
Size
190KB
-
MD5
fedb687ed23f77925b35623027f799bb
-
SHA1
7f27d0290ecc2c81bf2b2d0fa1026f54fd687c81
-
SHA256
325396d5ffca8546730b9a56c2d0ed99238d48b5e1c3c49e7d027505ea13b8d1
-
SHA512
6d1fa39560f4d7ca57905bc57d615acf96b1ef69ca2a4d7c0353278e8d4466298ed87f514463c49d671cb0e3b6a269a78636a10a1e463dba5c83fe067dc5df18
-
SSDEEP
3072:XqsEJybpRHuJKKBardRei4UGvI96/ZO6RAkeOCeP9sZy28se:XqsMyNRHuKikUi42KZO6PffmZy2d
Malware Config
Extracted
vidar
10.7
877956da9963e0825aa43a159a358f24
https://steamcommunity.com/profiles/76561199751190313
https://t.me/pech0nk
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Signatures
-
Detect Vidar Stealer 5 IoCs
resource yara_rule behavioral2/memory/3612-4-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral2/memory/3612-9-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral2/memory/3612-7-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral2/memory/3612-14-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral2/memory/3612-15-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 -
Vidar family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3156 set thread context of 3612 3156 66bddfcb52736_vidar.exe 84 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66bddfcb52736_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4392 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3156 wrote to memory of 4176 3156 66bddfcb52736_vidar.exe 83 PID 3156 wrote to memory of 4176 3156 66bddfcb52736_vidar.exe 83 PID 3156 wrote to memory of 4176 3156 66bddfcb52736_vidar.exe 83 PID 3156 wrote to memory of 3612 3156 66bddfcb52736_vidar.exe 84 PID 3156 wrote to memory of 3612 3156 66bddfcb52736_vidar.exe 84 PID 3156 wrote to memory of 3612 3156 66bddfcb52736_vidar.exe 84 PID 3156 wrote to memory of 3612 3156 66bddfcb52736_vidar.exe 84 PID 3156 wrote to memory of 3612 3156 66bddfcb52736_vidar.exe 84 PID 3156 wrote to memory of 3612 3156 66bddfcb52736_vidar.exe 84 PID 3156 wrote to memory of 3612 3156 66bddfcb52736_vidar.exe 84 PID 3156 wrote to memory of 3612 3156 66bddfcb52736_vidar.exe 84 PID 3156 wrote to memory of 3612 3156 66bddfcb52736_vidar.exe 84 PID 3156 wrote to memory of 3612 3156 66bddfcb52736_vidar.exe 84 PID 3612 wrote to memory of 2296 3612 RegAsm.exe 88 PID 3612 wrote to memory of 2296 3612 RegAsm.exe 88 PID 3612 wrote to memory of 2296 3612 RegAsm.exe 88 PID 2296 wrote to memory of 4392 2296 cmd.exe 90 PID 2296 wrote to memory of 4392 2296 cmd.exe 90 PID 2296 wrote to memory of 4392 2296 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\66bddfcb52736_vidar.exe"C:\Users\Admin\AppData\Local\Temp\66bddfcb52736_vidar.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4176
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & rd /s /q "C:\ProgramData\JJJJDAAECGHD" & exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4392
-
-
-