vidar | a63a4bef804fd6e29dfb03780c4b68d353b848d952573465d4a019b452c56e51

General

Target
mpclient.dll
Size 2.4MB
Sample260420-qa82lsft5w
SHA256 a63a4bef804fd6e29dfb03780c4b68d353b848d952573465d4a019b452c56e51
MD5 e130afe300fc8dad62b37afa5a82dfcf
SHA1 2e357aaa105ce7e5b7cd988fda1fb6d450a04913
SHA512 ee5e4eb6222863db1a5d0cf8d06b28bf34bf88c39c2f0d079cc956e9ae622bbd9d2b9836eed9dbe3e4c46e4a47396de26b5f20fb879dafefa93c564c15473255
SSDEEP 24576:084lQWyOUzPx49lMUe0/tLbSKaRMiND8OAVDV9GizX5NNyJkueB:0XuWy1xizeGVaMpVDVb0eB
TLSH
T112C58C0AADD04876C4AAA3368CB752967735F8581B3723C72E236A782FF37D05975390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery vidar spyware stealer

Malware Config

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/4656-1-0x0000000140000000-0x00000001400FE000-memory.dmp	family_vidar_v15
behavioral1/memory/4656-15-0x0000000140000000-0x00000001400FE000-memory.dmp	family_vidar_v15

Badlisted process makes network request 21 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4656	rundll32.exe
6	4656	rundll32.exe
12	4656	rundll32.exe
13	4656	rundll32.exe
15	4656	rundll32.exe
19	4656	rundll32.exe
21	4656	rundll32.exe
20	4656	rundll32.exe
22	4656	rundll32.exe
23	4656	rundll32.exe
24	4656	rundll32.exe
40	4656	rundll32.exe
43	4656	rundll32.exe
44	4656	rundll32.exe
49	4656	rundll32.exe
50	4656	rundll32.exe
52	4656	rundll32.exe
53	4656	rundll32.exe
63	4656	rundll32.exe
64	4656	rundll32.exe
65	4656	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1088	4656	rundll32.exe	93
PID 1088 wrote to memory of 2612	1088	chrome.exe	94
PID 4656 wrote to memory of 1088	4656	rundll32.exe	93
PID 4656 wrote to memory of 3460	4656	rundll32.exe	99
PID 3460 wrote to memory of 4564	3460	chrome.exe	100
PID 4656 wrote to memory of 3460	4656	rundll32.exe	99

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mpclient.dll,#1
1⤵
- Badlisted process makes network request
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe3e73c728,0x7ffe3e73c734,0x7ffe3e73c740
    3⤵
    PID:2612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe3e73c728,0x7ffe3e73c734,0x7ffe3e73c740
    3⤵
    PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 06f5dae68cd477e5f5001dc65ab190cc7b65011022066621b1a76a16fe269481
MD5 c0902111fbf560d9a8d7782c0b09c5a8
SHA1 6de9e897d3fbd1e23652b2cc4347a91f9d7a7717
SHA512 53e018d34c0084fc92bee5b6a115c41bc7671ef8bf16be373c0f7b60a3b8636fd2b5e912fd60f207e7dbcf80d47bac947a4432f54eafb0b302bf715e7932525d
MD5 SHA1 SHA512

Submit Download

memory/4656-0-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/4656-1-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/4656-13-0x00007FFE4C200000-0x00007FFE4C494000-memory.dmp

Download

memory/4656-15-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/4656-14-0x00000127DDCA0000-0x00000127DE3DF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads