vidar | fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1

General

Target
fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
Size 355KB
Sample260826-bt7wbs1dph
SHA256 fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1
MD5 5e3c0f6038314b2c9edd26e890890d50
SHA1 5ea33c0aa5d405c591812dfc44e93bba7ca858cd
SHA512 8d172b052e5a561983087782cdcd7b87d5b613e05f7c85fecc6216f5679975959e2c93bd16c0a3378fa30083b9b141aa9e4a0b4787fce1ae0cc7204fa8adbe6c
SSDEEP 6144:lO4IDZb8FS9lyKe2xX7FMzpMTenaulUheWckh8Y3ixkeZNfHuYEMcQ:lO4I8k9bTxZMyToZweBk/SkeZNfBEl
TLSH
T100741257E815880AEDE1D571037C46A92B9E3B6C76DACB3187AF87643740F2F964243C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

192f919e10529a3ec6db19d43b245812 defense_evasion vidar stealer upx

Malware Config

Extracted

Family

vidar

Version

3.1

Botnet

192f919e10529a3ec6db19d43b245812

C2

https://telegram.me/s11yne
https://dev.epicgames.com/community/api/user_profiles/profile.json?hash_id=roAjr
https://steamcommunity.com/profiles/76561198652917381

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:34.0) Gecko/20100101 Firefox/34.0

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Enumerates VirtualBox registry keys 2 TTPs 5 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5800-0-0x00007FF671590000-0x00007FF671828000-memory.dmp	upx
behavioral2/memory/5800-1-0x00007FF671590000-0x00007FF671828000-memory.dmp	upx

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\BIOS	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5800	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
5800	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
5800	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
5800	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
5800	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
5800	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
5800	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
5800	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
5800	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
5800	fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe

C:\Users\Admin\AppData\Local\Temp\fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe
"C:\Users\Admin\AppData\Local\Temp\fc02692a98927272e200e01eb80007cc03aedbdec8acfb68aa9730dabaa8fce1.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks system information in the registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

4

T1497

Credential Access

Discovery

Query Registry

7

T1012

System Information Discovery

4

T1082

Virtualization/Sandbox Evasion

4

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5800-0-0x00007FF671590000-0x00007FF671828000-memory.dmp

Download

memory/5800-1-0x00007FF671590000-0x00007FF671828000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads