vidar | 324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26

Analysis

max time kernel
141s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26.exe
Size

336.4MB
MD5

876f5de542386abdc4699b77687e279e
SHA1

24c0161a3968a97443be2cd1d1d96181285947bd
SHA256

324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26
SHA512

d1f12d0611093008d707d04c58dbae510dc84dfeb738a8052c174e2d2b5225226b398417ae918bb64792e41cec69eec4cc7ad66d7c15de0e6c664d3baa897f5b
SSDEEP

98304:3QHpw7wLHY5E5ThVOTYheiqTBODGm/RygXAWVWCwi+1j7:AHpw7v5EPuBxeIhWVJw/1P

Score

10^/10

vidar 670 discovery evasion stealer trojan

Malware Config

Extracted

Family

vidar

Version

51.9

Botnet

670

https://t.me/btc20220425

https://ieji.de/@ronxik213

Attributes

profile_id
670

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	JaffaCakes118_324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26.exe

Vidar Stealer 18 IoCs

stealer

resource	yara_rule
behavioral1/memory/2076-25-0x0000000000FB0000-0x00000000016DE000-memory.dmp	family_vidar
behavioral1/memory/2076-27-0x0000000000FB0000-0x00000000016DE000-memory.dmp	family_vidar
behavioral1/memory/2076-26-0x0000000000FB0000-0x00000000016DE000-memory.dmp	family_vidar
behavioral1/memory/2076-28-0x0000000000FB0000-0x00000000016DE000-memory.dmp	family_vidar
behavioral1/memory/2076-30-0x0000000000FB0000-0x00000000016DE000-memory.dmp	family_vidar
behavioral1/memory/2076-29-0x0000000000FB0000-0x00000000016DE000-memory.dmp	family_vidar
behavioral1/memory/2076-34-0x0000000000FB0000-0x00000000016DE000-memory.dmp	family_vidar
behavioral1/memory/2076-33-0x0000000000FB0000-0x00000000016DE000-memory.dmp	family_vidar
behavioral1/memory/2076-32-0x0000000000FB0000-0x00000000016DE000-memory.dmp	family_vidar
behavioral1/memory/2076-31-0x0000000000FB0000-0x00000000016DE000-memory.dmp	family_vidar
behavioral1/memory/2076-35-0x0000000000FB0000-0x00000000016DE000-memory.dmp	family_vidar
behavioral1/memory/2076-37-0x0000000000FB0000-0x00000000016DE000-memory.dmp	family_vidar
behavioral1/memory/2076-38-0x0000000000FB0000-0x00000000016DE000-memory.dmp	family_vidar
behavioral1/memory/2076-39-0x0000000000FB0000-0x00000000016DE000-memory.dmp	family_vidar
behavioral1/memory/2076-54-0x0000000000FB0000-0x00000000016DE000-memory.dmp	family_vidar
behavioral1/memory/2076-43-0x0000000000FB0000-0x00000000016DE000-memory.dmp	family_vidar
behavioral1/memory/2076-55-0x0000000000FB0000-0x00000000016DE000-memory.dmp	family_vidar
behavioral1/memory/2076-77-0x0000000000FB0000-0x00000000016DE000-memory.dmp	family_vidar

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	JaffaCakes118_324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	JaffaCakes118_324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	JaffaCakes118_324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2076	JaffaCakes118_324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26.exe
2076	JaffaCakes118_324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2076	JaffaCakes118_324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26.exe
2076	JaffaCakes118_324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-1-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-0-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-2-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-3-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-4-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-8-0x0000000000FB1000-0x0000000000FE8000-memory.dmp

Filesize
220KB

Download
memory/2076-7-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2076-5-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-9-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-10-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-6-0x00000000000F0000-0x0000000000136000-memory.dmp

Filesize
280KB

Download
memory/2076-11-0x0000000075F10000-0x0000000075FBC000-memory.dmp

Filesize
688KB

Download
memory/2076-13-0x0000000076090000-0x00000000761EC000-memory.dmp

Filesize
1.4MB

Download
memory/2076-14-0x0000000074870000-0x0000000074A00000-memory.dmp

Filesize
1.6MB

Download
memory/2076-17-0x0000000076600000-0x000000007671D000-memory.dmp

Filesize
1.1MB

Download
memory/2076-18-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-19-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-16-0x0000000076B90000-0x0000000076B9C000-memory.dmp

Filesize
48KB

Download
memory/2076-20-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-15-0x0000000074CE0000-0x0000000074D27000-memory.dmp

Filesize
284KB

Download
memory/2076-21-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-22-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-23-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-25-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-27-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-26-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-24-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-28-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-30-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-29-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-34-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-33-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-32-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-31-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-35-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-36-0x0000000000FB1000-0x0000000000FE8000-memory.dmp

Filesize
220KB

Download
memory/2076-37-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-38-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-39-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-41-0x0000000074B00000-0x0000000074B0B000-memory.dmp

Filesize
44KB

Download
memory/2076-42-0x0000000074620000-0x0000000074637000-memory.dmp

Filesize
92KB

Download
memory/2076-49-0x0000000076090000-0x00000000761EC000-memory.dmp

Filesize
1.4MB

Download
memory/2076-50-0x0000000076600000-0x000000007671D000-memory.dmp

Filesize
1.1MB

Download
memory/2076-54-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-53-0x0000000074620000-0x0000000074637000-memory.dmp

Filesize
92KB

Download
memory/2076-46-0x0000000075F10000-0x0000000075FBC000-memory.dmp

Filesize
688KB

Download
memory/2076-44-0x0000000074CE0000-0x0000000074D27000-memory.dmp

Filesize
284KB

Download
memory/2076-43-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-62-0x0000000076600000-0x000000007671D000-memory.dmp

Filesize
1.1MB

Download
memory/2076-61-0x0000000076090000-0x00000000761EC000-memory.dmp

Filesize
1.4MB

Download
memory/2076-55-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download
memory/2076-72-0x0000000076090000-0x00000000761EC000-memory.dmp

Filesize
1.4MB

Download
memory/2076-69-0x0000000075F10000-0x0000000075FBC000-memory.dmp

Filesize
688KB

Download
memory/2076-77-0x0000000000FB0000-0x00000000016DE000-memory.dmp

Filesize
7.2MB

Download