Overview

overview

10

Static

static

10

build.exe

windows7-x64

10

build.exe

windows10-ltsc 2021-x64

10

build.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250207-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250207-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    08-02-2025 16:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    build.exe

  • Size

    119KB

  • MD5

    08388bb4894c71e7b1be4bad966c3824

  • SHA1

    7437ac98f08fc41283b900aa6fb0ae350d59dd6c

  • SHA256

    986a98dc33a925fa232e1e5311807c7681cad9e0f07957d81e4f2f8257503f9c

  • SHA512

    2adf5154e7dca7de1fcf12560c97f1b74e66fb3c5074d8fa9d29dd9da91a1314f9fc18270808c12364c4941a6a2346109824bd4c625df905f9be84af393934b3

  • SSDEEP

    3072:8Ho0VvS7fw67XojiwHjwlntccGGLz9VkYFP+WR9pLhbFnhSe2e2e2nw:41VvSM6ziiw0cMLzDj9VBne

Score
10/10
vidaradwarediscoverypersistenceprivilege_escalationstealer

Malware Config

Extracted

Family

vidar

C2

https://t.me/sc1phell

https://steamcommunity.com/profiles/76561199819539662
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0

Signatures

  • Detect Vidar Stealer 2 IoCs
    stealer
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 10 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 35 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1924
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUQ1RDRDMTEtRUY1Qy00QTcwLUI2NEMtNDBGNkNGOUFFQ0MyfSIgdXNlcmlkPSJ7NTk4QUQzN0YtOERCQi00QzdBLUEzNzgtMTdGNTAzNTg3RkU3fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RTk5OTRDNUItQTRDRS00N0M2LTkzRUYtOTZFNDlCQjE2NzExfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMSIgaW5zdGFsbGRhdGV0aW1lPSIxNzM4OTM1NTUwIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODM0MDc5ODYzMjgwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTMwMjQxMjc3OCIvPjwvYXBwPjwvcmVxdWVzdD4
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:4720
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{39999883-C12B-413B-BED2-46089FE12134}\MicrosoftEdge_X64_132.0.2957.140.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{39999883-C12B-413B-BED2-46089FE12134}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3984
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{39999883-C12B-413B-BED2-46089FE12134}\EDGEMITMP_4AFEB.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{39999883-C12B-413B-BED2-46089FE12134}\EDGEMITMP_4AFEB.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{39999883-C12B-413B-BED2-46089FE12134}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2612
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{39999883-C12B-413B-BED2-46089FE12134}\EDGEMITMP_4AFEB.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{39999883-C12B-413B-BED2-46089FE12134}\EDGEMITMP_4AFEB.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{39999883-C12B-413B-BED2-46089FE12134}\EDGEMITMP_4AFEB.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7745ea818,0x7ff7745ea824,0x7ff7745ea830
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:2104
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{39999883-C12B-413B-BED2-46089FE12134}\EDGEMITMP_4AFEB.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{39999883-C12B-413B-BED2-46089FE12134}\EDGEMITMP_4AFEB.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:2204
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{39999883-C12B-413B-BED2-46089FE12134}\EDGEMITMP_4AFEB.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{39999883-C12B-413B-BED2-46089FE12134}\EDGEMITMP_4AFEB.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{39999883-C12B-413B-BED2-46089FE12134}\EDGEMITMP_4AFEB.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7745ea818,0x7ff7745ea824,0x7ff7745ea830
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:1116
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3244
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7f240a818,0x7ff7f240a824,0x7ff7f240a830
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:4636
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2380
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7f240a818,0x7ff7f240a824,0x7ff7f240a830
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:4512
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3524
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7f240a818,0x7ff7f240a824,0x7ff7f240a830
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:4004
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
    1⤵
      PID:4088

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{39999883-C12B-413B-BED2-46089FE12134}\EDGEMITMP_4AFEB.tmp\setup.exe
      Filesize

      6.6MB

      MD5

      b4c8ad75087b8634d4f04dc6f92da9aa

      SHA1

      7efaa2472521c79d58c4ef18a258cc573704fb5d

      SHA256

      522a25568bb503cf8b44807661f31f0921dee91d37691bf399868733205690bf

      SHA512

      5094505b33a848badcffd6b3b93aad9ad73f391e201dee052376c4f8573ba351f0b8c102131216088ffb38d0ed7b5fe70ba95c3ac2c33a50c993584fe7c435e3

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J5O25WIZ\76561199819539662[1].htm
      Filesize

      34KB

      MD5

      2a0879df337cd4278157953e15ae87d9

      SHA1

      99fcf5fea4fc89ef7a18c884b8c2f76ad8f9c430

      SHA256

      7ed5efeb12c5aafa0b2d431ea265126bf80745983b7f935e7b9080105b069665

      SHA512

      1c243b708599c1236f8d8de142e518fc82ce9723af71a533a111c5cc688c1c0d5e7b1ce72ef5eeb6b6707d95b7cae8101f7340007b815384a28e90b7689be190

      Download Submit

    • C:\Windows\SystemTemp\msedge_installer.log
      Filesize

      72KB

      MD5

      d1a9bbd018fff23940b016fed7628b36

      SHA1

      f8893a7325230f69514cad3db3330d8e458c4844

      SHA256

      a3f7d71bac4d2ef9564418d4abe3b9ea049213c7aa7a262cddff3529978321f0

      SHA512

      d62dbef6fa65ee6b6ac9a6617ab3aa73a006c57592c064c8e8bbe129c4df7bf51ae5ad3fa81c3799e2954f47ea712ea14c77b1b3a9bd323ead16d38a59b12b88

      Download Submit

    • C:\Windows\SystemTemp\msedge_installer.log
      Filesize

      101KB

      MD5

      9a084541da3558e615ff4e8637452780

      SHA1

      3fe3d9c6267b2c722fb154df1635e84ec80d1d49

      SHA256

      1f1120b84b8e921f03e30137d3ff3080e75aeb7bd2a3bd8d319000f1338b2935

      SHA512

      73bd394db00f85256b561950de7907747be344cfbc90ef4d32e339c9700a6e2f05a52b78e9c8a3521bf5b80eb38906219f9c60177ab92692dd44d998b7b68ebc

      Download Submit

    • C:\Windows\SystemTemp\msedge_installer.log
      Filesize

      103KB

      MD5

      61599bf6db304f3a5b342f9b3af06fc9

      SHA1

      5481cb8ac671cf685090d1e085cacd47136f98fa

      SHA256

      055f8304a4cff042704acbbfafc42b7835cbe7521b90a4bae1dbf6c48eb390f8

      SHA512

      cbaeb56f8c9bacc39002817d00201f2bc033e0288ddd4155fb3b9ccf5cec0e842251b8aaf700c78c255bd65b17896930497eb195f4e4c55220c2a00c6f6cc784

      Download Submit

    • memory/1924-0-0x0000000000400000-0x0000000000422000-memory.dmp

      Filesize

      136KB

      Download

    • memory/1924-7-0x0000000000400000-0x0000000000422000-memory.dmp

      Filesize

      136KB

      Download