vidar | 26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c

Analysis

max time kernel
93s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
Size

738.0MB
MD5

06b546702677e85f237d31533d59ebdd
SHA1

f1765a9e3e3127cf6ddcdaa50de09a8e3da08529
SHA256

26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c
SHA512

93c65ed2e6f937b6e3b30dbee56b1493aca3bf1fde5e8e22a12d5c046216817b81c2265b84310c685640084eba55832cca4fa11196e575706cc677ea8713e8fe
SSDEEP

24576:pOWmAFb8/ELdt9Mcp/D8mh93J/y4kBB99abgklaJAJ4UAD8P6OFB:pFLdRp/19Z/KBvaOASUy8Pbz

Score

10^/10

vidar discovery stealer upx

Malware Config

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Executes dropped EXE 2 IoCs

pid	Process
4868	Engine.exe
2824	Holder.exe.pif

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023c87-9.dat	upx
behavioral2/memory/4868-11-0x0000000000400000-0x0000000000558000-memory.dmp	upx
behavioral2/memory/4868-70-0x0000000000400000-0x0000000000558000-memory.dmp	upx
behavioral2/memory/4868-73-0x0000000000400000-0x0000000000558000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Holder.exe.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Engine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3856	PING.EXE

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1045960512-3948844814-3059691613-1000\{A49C0364-D07E-4265-905D-A17111141E48}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1045960512-3948844814-3059691613-1000\{9C2E8DEB-80BB-4A3D-B60C-0117D9E6CEC0}	svchost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3856	PING.EXE

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
4620	powershell.exe
4620	powershell.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
4620	powershell.exe
3888	powershell.exe
3888	powershell.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
3888	powershell.exe
2824	Holder.exe.pif
2824	Holder.exe.pif
2824	Holder.exe.pif
2824	Holder.exe.pif
2824	Holder.exe.pif
2824	Holder.exe.pif
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
2824	Holder.exe.pif
2824	Holder.exe.pif
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeDebugPrivilege	3888	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2824	Holder.exe.pif
2824	Holder.exe.pif
2824	Holder.exe.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2824	Holder.exe.pif
2824	Holder.exe.pif
2824	Holder.exe.pif

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
384	OpenWith.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 4868	1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe	83
PID 1524 wrote to memory of 4868	1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe	83
PID 1524 wrote to memory of 4868	1524	JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe	83
PID 4868 wrote to memory of 1304	4868	Engine.exe	85
PID 4868 wrote to memory of 1304	4868	Engine.exe	85
PID 4868 wrote to memory of 1304	4868	Engine.exe	85
PID 1304 wrote to memory of 1004	1304	cmd.exe	88
PID 1304 wrote to memory of 1004	1304	cmd.exe	88
PID 1304 wrote to memory of 1004	1304	cmd.exe	88
PID 1004 wrote to memory of 4620	1004	cmd.exe	89
PID 1004 wrote to memory of 4620	1004	cmd.exe	89
PID 1004 wrote to memory of 4620	1004	cmd.exe	89
PID 1004 wrote to memory of 3888	1004	cmd.exe	90
PID 1004 wrote to memory of 3888	1004	cmd.exe	90
PID 1004 wrote to memory of 3888	1004	cmd.exe	90
PID 1004 wrote to memory of 2824	1004	cmd.exe	91
PID 1004 wrote to memory of 2824	1004	cmd.exe	91
PID 1004 wrote to memory of 2824	1004	cmd.exe	91
PID 1004 wrote to memory of 3856	1004	cmd.exe	92
PID 1004 wrote to memory of 3856	1004	cmd.exe	92
PID 1004 wrote to memory of 3856	1004	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Local\Temp\SETUP_22061\Engine.exe
  C:\Users\Admin\AppData\Local\Temp\SETUP_22061\Engine.exe /TH_ID=_1608 /OriginExe="C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26e44d8181ad3a379fab42b8047a2b115fc968f0d34d3e17af6d4c772846cd8c.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cmd < 51
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1004
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell get-process avastui
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4620
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell get-process avgui
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\t0tycnl0.mlf\20792\Holder.exe.pif
        
        20792\\Holder.exe.pif 20792\\h
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2824
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping localhost -n 8
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3856

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
def65711d78669d7f8e69313be4acf2e

SHA1
6522ebf1de09eeb981e270bd95114bc69a49cda6

SHA256
aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

SHA512
05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
e483bbc187232a196182b4ed65884b5a

SHA1
0d51b6857dc85588d4456ca638180ca7a0d00157

SHA256
9290ce4cbfdf41e0f232f5b687ff7e5fb2aeb24185ad22c6f697a3d84cc11c27

SHA512
bd20e8e9c9c4b078cb75bc8f1f8c0649413aed5c316df794253f07d750620bfdbd13fb696b168e341e5ce3c2df5d0503a0b5cdfa6142f13cf36d6cc31ca9b67e

Download Submit
C:\Users\Admin\AppData\Local\Temp\SETUP_22061\00000#3

Filesize
858KB

MD5
906254f76e33db6972339f9b59edd41e

SHA1
b9af89077038661adfd4c8561d23e5c72edd51eb

SHA256
81ff6f9b48edaaa9d8ed5815699166f96cc645859cd1f3650d4e12525ecf6fc0

SHA512
ecce108dd2637474240cf88a8b6e6450598df3b8a1c23ab5ecb20b59c9c1788a051f3ad33acab51fcd988c0bf2d2ebc84da86c63922167aa4fbb5299752186cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\SETUP_22061\00001#4

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\SETUP_22061\00002#51

Filesize
11KB

MD5
0b06381eae076e75e2f2e763c4c22594

SHA1
ef08c9e28456ed71a1db5485cfcd1c7b84ef246a

SHA256
492835bac0239b83628e24325ebcb35eb90de592b2b084af720c684262933c88

SHA512
41f70d9fa01a04eba6e2694ec39b20583cb96103fb39096a39fa17a3b9058547fd52c9956ab67b79caad280848f6556cc72f8732c4b2886273d2ae0ad1a4b675

Download Submit
C:\Users\Admin\AppData\Local\Temp\SETUP_22061\Engine.exe

Filesize
392KB

MD5
a7a99a201774531d761f6aac2651a9df

SHA1
b122ae368c4bf103e959a6ebb54ddb310117ab96

SHA256
e6e73497e85e9ece4c92ac7d49e07b9d55e932ba2d9e5789b94b95a9841ee524

SHA512
056504da2afeed547a4123ac8c38b35291b7dc0126fb638ae304eee802ac572715f9d608e9f1655788a030f488354741ee27c805434111c8e915cf841c0892f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\SETUP_22061\Modern_Icon.bmp

Filesize
7KB

MD5
1dd88f67f029710d5c5858a6293a93f1

SHA1
3e5ef66613415fe9467b2a24ccc27d8f997e7df6

SHA256
b5dad33ceb6eb1ac2a05fbda76e29a73038403939218a88367925c3a20c05532

SHA512
7071fd64038e0058c8c586c63c62677c0ca403768100f90323cf9c0bc7b7fcb538391e6f3606bd7970b8769445606ada47adcdcfc1e991e25caf272a13e10c94

Download Submit
C:\Users\Admin\AppData\Local\Temp\SETUP_22061\Setup.txt

Filesize
2KB

MD5
af68eacd61c521ccb259736498a9e184

SHA1
4bd8f8eb2b72f84589b02758036e9b42b0f38fae

SHA256
477d97fcae131b68b26b4dc967f8e0f4eedbc2ff5e95f944e1d6c748d25525ec

SHA512
d0a207141e98b27ab794b66b5f040e01b728725142de6f41c7d7bc7a9b819d4dbf75a0a33d62aec90ff5c881ff1a273091bac617b65b4d6d0e024b8c807a9d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lofkuh2q.fej.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
memory/1524-77-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1524-53-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2824-79-0x0000000004E10000-0x0000000004E70000-memory.dmp

Filesize
384KB

Download
memory/2824-78-0x0000000004E10000-0x0000000004E70000-memory.dmp

Filesize
384KB

Download
memory/2824-80-0x0000000004E10000-0x0000000004E70000-memory.dmp

Filesize
384KB

Download
memory/2824-81-0x0000000004E10000-0x0000000004E70000-memory.dmp

Filesize
384KB

Download
memory/2824-82-0x0000000004E10000-0x0000000004E70000-memory.dmp

Filesize
384KB

Download
memory/3888-66-0x0000000005820000-0x0000000005B74000-memory.dmp

Filesize
3.3MB

Download
memory/4620-34-0x0000000004D50000-0x0000000004D72000-memory.dmp

Filesize
136KB

Download
memory/4620-48-0x0000000005C10000-0x0000000005C5C000-memory.dmp

Filesize
304KB

Download
memory/4620-32-0x0000000000E30000-0x0000000000E66000-memory.dmp

Filesize
216KB

Download
memory/4620-52-0x00000000071F0000-0x0000000007794000-memory.dmp

Filesize
5.6MB

Download
memory/4620-33-0x0000000004ED0000-0x00000000054F8000-memory.dmp

Filesize
6.2MB

Download
memory/4620-47-0x0000000005BE0000-0x0000000005BFE000-memory.dmp

Filesize
120KB

Download
memory/4620-46-0x0000000005650000-0x00000000059A4000-memory.dmp

Filesize
3.3MB

Download
memory/4620-49-0x0000000006BA0000-0x0000000006C36000-memory.dmp

Filesize
600KB

Download
memory/4620-51-0x0000000006150000-0x0000000006172000-memory.dmp

Filesize
136KB

Download
memory/4620-50-0x00000000060D0000-0x00000000060EA000-memory.dmp

Filesize
104KB

Download
memory/4620-36-0x00000000055E0000-0x0000000005646000-memory.dmp

Filesize
408KB

Download
memory/4620-35-0x0000000005570000-0x00000000055D6000-memory.dmp

Filesize
408KB

Download
memory/4868-73-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4868-72-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/4868-70-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4868-12-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/4868-11-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download