Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/07/2026, 22:28
General
- Target Setup.exe
- Size 20.0MB
- Sample260711-2d2mgsc13w
- SHA256 55ea0cdc82a63317919669d1dd016da57823f0ba814399a76de28c623e558011
Malware Config
Extracted
-
vidar
-
2.3
-
4adf0689c53e323fa24342f3ae3cfdc7
-
https://77.42.49.112
-
https://telegram.me/af97ri
-
https://steamcommunity.com/profiles/76561198680197300
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\dllhost.exe"C:\Windows\System32\dllhost.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/548-0-0x000002439A6F0000-0x000002439A6F1000-memory.dmp
memory/548-7-0x00007FF66B630000-0x00007FF66B7B0000-memory.dmp
memory/4428-2-0x00000001E8500000-0x00000001E8726000-memory.dmp
memory/4428-8-0x00000001E8500000-0x00000001E8726000-memory.dmp
memory/4428-9-0x00000001E8500000-0x00000001E8726000-memory.dmp
memory/4428-10-0x00000001E8500000-0x00000001E8726000-memory.dmp
memory/4428-11-0x00000001E8500000-0x00000001E8726000-memory.dmp