vidar | 8a93c371ed2665a1a56771df666c526aa115484976ec41357fb4a4400450de97

General

Target
jaffacakes118_8a93c371ed2665a1a56771df666c526aa115484976ec41357fb4a4400450de97.exe
Size 574KB
Sample260910-vktf5asgkf
SHA256 8a93c371ed2665a1a56771df666c526aa115484976ec41357fb4a4400450de97
MD5 ca9ba66af1acfc56632bfc0e941a603a
SHA1 a45ad42658dc4be3a31812f48449979bf4db329a
SHA512 316471f34ace19ce994980ee91540bdcad3588bd1fa0bc3148497519f949549a2ec560882cf67959054b5284ef56d8ec3116e92d868906ec5f198e1a8df55985
SSDEEP 12288:iKpPrW1hqMZGgFI7uztojc1yHVyCOJIAcLl56rQbuugW+N7w1:iKpPrWLVguztKIUVy6Ac36rQyubK
TLSH
T15CC4236A91C892EFD4150730338F7B5AFC176D46BBB78267B99254388F8B8607941C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

0ada9a4ce599d60058648ad4e3dd5c4a cego54 defense_evasion discovery execution vidar spyware stealer trojan upx

Malware Config

Extracted

Family

vidar

Botnet

0ada9a4ce599d60058648ad4e3dd5c4a

Campaign

cego54

C2

https://telegram.me/cego54

Extracted

Family

vidar

Botnet

0ada9a4ce599d60058648ad4e3dd5c4a

C2

https://192.177.26.164
https://telegram.me/cego54
https://steamcommunity.com/profiles/76561198761022496

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 8 IoCs

stealer

resource	yara_rule
behavioral2/memory/4900-1-0x00007FF634C60000-0x00007FF634DED000-memory.dmp	family_vidar_v15
behavioral2/memory/4900-3-0x00007FF634C60000-0x00007FF634DED000-memory.dmp	family_vidar_v15
behavioral2/memory/4900-6-0x00007FF634C60000-0x00007FF634DED000-memory.dmp	family_vidar_v15
behavioral2/memory/4900-24-0x00007FF634C60000-0x00007FF634DED000-memory.dmp	family_vidar_v15
behavioral2/memory/4900-31-0x00007FF634C60000-0x00007FF634DED000-memory.dmp	family_vidar_v15
behavioral2/memory/4900-32-0x00007FF634C60000-0x00007FF634DED000-memory.dmp	family_vidar_v15
behavioral2/memory/4900-34-0x00007FF634C60000-0x00007FF634DED000-memory.dmp	family_vidar_v15
behavioral2/memory/4900-36-0x00007FF634C60000-0x00007FF634DED000-memory.dmp	family_vidar_v15

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4900-0-0x00007FF634C60000-0x00007FF634DED000-memory.dmp	upx
behavioral2/memory/4900-1-0x00007FF634C60000-0x00007FF634DED000-memory.dmp	upx
behavioral2/memory/4900-3-0x00007FF634C60000-0x00007FF634DED000-memory.dmp	upx
behavioral2/memory/4900-6-0x00007FF634C60000-0x00007FF634DED000-memory.dmp	upx
behavioral2/memory/4900-24-0x00007FF634C60000-0x00007FF634DED000-memory.dmp	upx
behavioral2/memory/4900-31-0x00007FF634C60000-0x00007FF634DED000-memory.dmp	upx
behavioral2/memory/4900-32-0x00007FF634C60000-0x00007FF634DED000-memory.dmp	upx
behavioral2/memory/4900-34-0x00007FF634C60000-0x00007FF634DED000-memory.dmp	upx
behavioral2/memory/4900-36-0x00007FF634C60000-0x00007FF634DED000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4624	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4624	cmd.exe
4552	PING.EXE

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD98F9F3E47D753B65D482B3A45217BB6EF5E438	jaffacakes118_8a93c371ed2665a1a56771df666c526aa115484976ec41357fb4a4400450de97.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD98F9F3E47D753B65D482B3A45217BB6EF5E438\Blob = 5c0000000100000004000000001000000f00000001000000300000003f13d09d3d9c0e34359655f0e5825a21518c69617ac82a5c65d17cfe8e8958df5d328ac40821fb5116703b7601e9abfb0b000000010000005c0000005300650063007400690067006f0020005000750062006c006900630020005300650072007600650072002000410075007400680065006e007400690063006100740069006f006e00200052006f006f0074002000520034003600000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c06200000001000000200000007bb647a62aeeac88bf257aa522d01ffea395e0ab45c73f93f65654ec38f25a06090000000100000016000000301406082b0601050507030206082b060105050703011400000001000000140000005673586495f9921ab0122a046279a140158821491d00000001000000100000001e1771e068b859b9d2e89ea3a6db0e28030000000100000014000000ad98f9f3e47d753b65d482b3a45217bb6ef5e438190000000100000010000000d21153f3125a7dbce915d41563f733f420000000010000008e0500003082058a30820372a0030201020210758dfd8bae7c0700faa925a7e1c7ad14300d06092a864886f70d01010c0500305f310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564313630340603550403132d5365637469676f205075626c6963205365727665722041757468656e7469636174696f6e20526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a305f310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564313630340603550403132d5365637469676f205075626c6963205365727665722041757468656e7469636174696f6e20526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a028202010093bed5365275d80123a01c474249ee63b6b721fdc495d5482b267c145310da79fd2bb72da4d42cfaea32dd49c2b9bd0f483d7b5a9854af9e5d31744f07fc5021dda4cf684f1b12636d25994c2a99f3483061fa817c1ea7084adc3e2b1c1f184c71aa358cadf86ee83b4ad9e59402d6898413aa6dc84f33cc5096379233dc5f88e79f54d948f09843d666fd9f173843c501510bd7e3230f145d5b14e74bbeddf4c8da0337d1d639a121513083b06dd7304e965b91f07024abbf458164430dbd213a2f3ce99e0dcb20b54227ccda6f9bee64309039cd9365812131b52350333722e338edf83130cc45fe62f9d15d32794287df6acc5619404dceaabbf9b5764994f127f891a583e506b3630e80dce0125580a63b66b439872dc8f0d0d114e9e40d4d0ef65d5772c53b1c47569de2d5fb81618ccc4d8090345bb7d71475dcd804489fc0c12888b4e91ccaa7b1f156b77b494c59e52015a8840229fa3894699a49068fcd1f791417120c837ade1fb197eef9977828a4c84492e97d2605a658729b7913d8115faec538623468b286308ef890619e326cf50736cda24c6eec8a36edf2e699154470c37cbc9c39c0b4e16bf783252357d91280e549f0750fef8deb1c9b5428b4213cfc7c0affef7b6b75ff8b1da01905abfaf82b8142e838babbfbaafd3de0f3cadf4e979729edf31856e9a596acbdc39098b2e0f9a2d4a647437c6dcf0203010001a3423040301d0603551d0e041604145673586495f9921ab0122a046279a14015882149300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201002f5c993cfc065e8c942e70ead232318db4f051d5bc0af3649f075ed5c17368647aa2b90ee8f95d852da83745aa28f496055060a9497e9fe29936291344476a9d55203cd89bf10332bada40a173ea83a1b744a60e99019be4bc7fbe13947ecaa61e7680363d84068b3326656dca7e9efe1f8c58387b1a83b10fbc1711bbe606cc63fa81f2814cda0b106ba1fad528a5cf064016ff7b7d185e3912a4539e7e324210a62191a91c4e177c84bc9f8cd1e8dfe651b936473f90b9c7bc02dc5b1c4f0e48c125839c0a3f9eb10333121a27acf7226c24d10141f85803fe2568221f9a5a3c7c6c9e7548f381f166676e4c82c0eeba570e18ef2e9af712d8a06be905a5a1e968f8bc4c3f121e45e852c0a3bf122779b9cc313cc3f63a221603a0c98f66a45ba24dd6812506e976a4000a3ecbcd359be0e138cb6053862842411c4457e8a8adab45e32510bcdb3e6541fb1ba6970febb97479f91ebc1d570d47afc32f9f8746a7eb265a0f5663b562606e00fbe3271122e7fe998f34f5b9e8c39172bdd8c31eb92ef2914451d057cd0c34d54821bfdb13f166254352d2702236cd9fc41c7520ad637263060f0e27ced26a0dbcb5391ae9d1767ad15ce4e749492d553768f01a3a983e54178754e9a62750897b202f3fffbfa18b4a4798ff2b7b493ec32946601842ab3329bac029b91389d3888a39413bc9fda6ed1ff46063dfd22d55018b	jaffacakes118_8a93c371ed2665a1a56771df666c526aa115484976ec41357fb4a4400450de97.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4552	PING.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4624	4900	jaffacakes118_8a93c371ed2665a1a56771df666c526aa115484976ec41357fb4a4400450de97.exe	90
PID 4624 wrote to memory of 4552	4624	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8a93c371ed2665a1a56771df666c526aa115484976ec41357fb4a4400450de97.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8a93c371ed2665a1a56771df666c526aa115484976ec41357fb4a4400450de97.exe"
1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ping localhost -n 6 & del "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8a93c371ed2665a1a56771df666c526aa115484976ec41357fb4a4400450de97.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\system32\PING.EXE
    ping localhost -n 6
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4552