Analysis
- user interaction
yes - max time kernel
601s - max time network
605s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/10/2026, 21:57
General
- Target meetily-x64-setup.exe
- Size 83.1MB
- Sample261012-1t935a1xes
- SHA256 7b68565b58a6698fe90e4dabf2b9323bdb944a7aeb7a7e15bc346ab64db1ec0b
Malware Config
Extracted
-
vidar
-
3.8
-
4aca9c84836e25be8bfee5c151851638
-
https://t.me/scii0n
-
https://steamcommunity.com/profiles/7656119862204457
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
- Looks for VirtualBox drivers on disk 2 TTPs 8 IoCs
- Looks for VMWare Tools registry key 2 TTPs 2 IoCs
- Looks for VMWare drivers on disk 2 TTPs 4 IoCs
- Looks for VMWare services registry key. 1 TTPs 2 IoCs
- Modifies Windows Firewall 2 TTPs 6 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 23 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 18 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks system information in the registry 2 TTPs 3 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in Program Files directory 16 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 8 IoCs
- Gathers network information 2 TTPs 3 IoCs
Uses commandline utility to view network configuration.
- Modifies registry key 1 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 29 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\meetily-x64-setup.exe"C:\Users\Admin\AppData\Local\Temp\meetily-x64-setup.exe"1⤵
- Checks BIOS information in registry
- Checks system information in the registry
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exe"ipconfig"2⤵
- Gathers network information
-
-
C:\Windows\system32\getmac.exe"getmac" /FO CSV /NH2⤵
-
-
C:\Users\Public\Documents\UpdateHelper\ServiceModule\SkyBridge.exe"C:\Users\Public\Documents\UpdateHelper\ServiceModule\SkyBridge.exe"2⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Looks for VMWare drivers on disk
- Looks for VMWare services registry key.
- Executes dropped EXE
- Checks system information in the registry
- Drops file in Program Files directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exe"ipconfig"3⤵
- Gathers network information
-
-
C:\Windows\system32\getmac.exe"getmac" /FO CSV /NH3⤵
-
-
-
C:\Users\Public\Pictures\MicrosoftComponent\DisplayComponent\cloude_edge.exe"C:\Users\Public\Pictures\MicrosoftComponent\DisplayComponent\cloude_edge.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /Query /TN IntelGraphicsHost3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Create /TN IntelGraphicsHost /TR C:\ProgramData\gemini\genodeb.exe /F /RL HIGHEST /RU SYSTEM /SC ONSTART3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Query /TN OneDriveCloudSync3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Create /TN OneDriveCloudSync /TR C:\ProgramData\nodes\GeminiService.exe /F /RL HIGHEST /RU SYSTEM /SC ONSTART /DELAY 0001:003⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\OneSync.lnk'); $Shortcut.TargetPath = 'C:\Users\Public\OneSync.exe'; $Shortcut.Save()"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Query /TN ChromeSyncHost3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Create /TN ChromeSyncHost /TR C:\ProgramData\Graphics\GraphicsHost.exe /F /RL HIGHEST /RU SYSTEM /SC DAILY3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Public\Documents\AudioHost\USBModule\DeltaNet.exe"C:\Users\Public\Documents\AudioHost\USBModule\DeltaNet.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
C:\Users\Public\Documents\WindowsProcess\DriverHandler\node_ipsec.exe"C:\Users\Public\Documents\WindowsProcess\DriverHandler\node_ipsec.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall add rule name=Telemetry_In_57001 dir=in action=allow protocol=TCP localport=570013⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall add rule name=Telemetry_Out_57001 dir=out action=allow protocol=TCP localport=570013⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall add rule name=Telemetry_In_57002 dir=in action=allow protocol=TCP localport=570023⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall add rule name=Telemetry_Out_57002 dir=out action=allow protocol=TCP localport=570023⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall add rule name=Telemetry_In_56001 dir=in action=allow protocol=TCP localport=560013⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall add rule name=Telemetry_Out_56001 dir=out action=allow protocol=TCP localport=560013⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Create /F /SC ONLOGON /TN DataPruneJob /TR C:\Users\Public\Documents\WindowsProcess\DriverHandler\node_ipsec.exe /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\reg.exe"reg.exe" ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Run /f3⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Windows\system32\reg.exe"reg.exe" ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MetricsAgentSvc /t REG_SZ /d C:\Users\Public\Documents\WindowsProcess\DriverHandler\node_ipsec.exe /f3⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
C:\Users\Public\Pictures\DeviceSupport\SecurityProcess\vidb.exe"C:\Users\Public\Pictures\DeviceSupport\SecurityProcess\vidb.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Public\Videos\UpdateModule\IntelHost\serveless.exe"C:\Users\Public\Videos\UpdateModule\IntelHost\serveless.exe"2⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Looks for VMWare drivers on disk
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Checks system information in the registry
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exe"ipconfig"3⤵
- Gathers network information
-
-
C:\Windows\system32\getmac.exe"getmac" /FO CSV /NH3⤵
-
-
-
C:\Users\Public\Pictures\WindowsSupport\NetworkSupport\ntfs_au.exe"C:\Users\Public\Pictures\WindowsSupport\NetworkSupport\ntfs_au.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Public\Pictures\MicrosoftComponent\DisplayComponent\cloude_edge.exeC:\Users\Public\Pictures\MicrosoftComponent\DisplayComponent\cloude_edge.exe1⤵
- Executes dropped EXE
-
C:\ProgramData\gemini\genodeb.exeC:\ProgramData\gemini\genodeb.exe1⤵
- Executes dropped EXE
-
C:\ProgramData\nodes\geminsync.exeC:\ProgramData\nodes\geminsync.exe1⤵
- Executes dropped EXE
-
C:\Users\Public\SQLite\sqlite-host.exeC:\Users\Public\SQLite\sqlite-host.exe1⤵
- Executes dropped EXE
-
C:\ProgramData\nodes\GeminiService.exeC:\ProgramData\nodes\GeminiService.exe1⤵
- Executes dropped EXE
-
C:\Users\Public\OneSync.exeC:\Users\Public\OneSync.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Oracle\VirtualBox\VBoxVMM-service.exe"C:\Program Files\Oracle\VirtualBox\VBoxVMM-service.exe"1⤵
- Executes dropped EXE
-
C:\ProgramData\Graphics\GraphicsHost.exeC:\ProgramData\Graphics\GraphicsHost.exe1⤵
- Executes dropped EXE
-
C:\Users\Public\Videos\UpdateModule\IntelHost\serveless.exeC:\Users\Public\Videos\UpdateModule\IntelHost\serveless.exe1⤵
- Executes dropped EXE
-
C:\Users\Public\ngrok\ngrok-daemon.exeC:\Users\Public\ngrok\ngrok-daemon.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Chef\chef-client-service.exe"C:\Program Files\Chef\chef-client-service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Nmap\ncat-daemon.exe"C:\Program Files\Nmap\ncat-daemon.exe"1⤵
- Executes dropped EXE
-
C:\PROGRA~1\Nginx\nginx-service.exeC:\PROGRA~1\Nginx\NGINX-~1.EXE1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Program Files\osquery\osqueryd.exe"C:\Program Files\osquery\osqueryd.exe"1⤵
- Executes dropped EXE
-
C:\PROGRA~1\MOZILL~1\firefox-service.exeC:\PROGRA~1\MOZILL~1\FIREFO~1.EXE1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Users\Public\Documents\WindowsProcess\DriverHandler\node_ipsec.exeC:\Users\Public\Documents\WindowsProcess\DriverHandler\node_ipsec.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Virtualization/Sandbox Evasion
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
system_log.txt
upd152b_log.txt
.test_write_access
DeltaNet.exe
SkyBridge.exe
node_ipsec.exe
vidb.exe
cloude_edge.exe
ntfs_au.exe
serveless.exe
memory/3060-117-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-132-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-115-0x000001AC984B0000-0x000001AC98514000-memory.dmp
memory/3060-2016-0x000001AC98710000-0x000001AC98716000-memory.dmp
memory/3060-124-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-141-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-147-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-152-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-158-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-116-0x000001AC98630000-0x000001AC9870C000-memory.dmp
memory/3060-114-0x000001AC98350000-0x000001AC983FE000-memory.dmp
memory/3060-120-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-123-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-126-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-128-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-164-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-135-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-138-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-143-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-144-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-149-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-151-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-154-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-160-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-118-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-156-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/3060-163-0x000001AC98630000-0x000001AC98706000-memory.dmp
memory/4756-2021-0x000001BA73CA0000-0x000001BA73CC2000-memory.dmp
memory/4928-0-0x000001CB43A60000-0x000001CB43A61000-memory.dmp
memory/4928-2-0x000001CB43A60000-0x000001CB43A61000-memory.dmp
memory/5008-99-0x0000000005350000-0x000000000535B000-memory.dmp
memory/5008-90-0x0000000004900000-0x0000000004A26000-memory.dmp
memory/5008-80-0x0000000002020000-0x0000000002136000-memory.dmp
memory/5008-83-0x0000000002CD0000-0x0000000002CFA000-memory.dmp
memory/5008-82-0x0000000000F30000-0x0000000000F57000-memory.dmp
memory/5008-78-0x0000000001B50000-0x0000000001C9B000-memory.dmp
memory/5008-79-0x0000000001CA0000-0x000000000201C000-memory.dmp
memory/5008-74-0x0000000001390000-0x0000000001731000-memory.dmp
memory/5008-76-0x00000000019C0000-0x0000000001A96000-memory.dmp
memory/5008-81-0x0000000002B00000-0x0000000002CC3000-memory.dmp
memory/5008-89-0x0000000004810000-0x00000000048B7000-memory.dmp
memory/5008-92-0x0000000004BC0000-0x0000000004C82000-memory.dmp
memory/5008-93-0x0000000004C90000-0x0000000004CF8000-memory.dmp
memory/5008-94-0x0000000004D00000-0x0000000004D32000-memory.dmp
memory/5008-95-0x0000000004D40000-0x0000000004D4E000-memory.dmp
memory/5008-96-0x0000000004650000-0x000000000465A000-memory.dmp
memory/5008-97-0x0000000004E90000-0x0000000004ED8000-memory.dmp
memory/5008-88-0x0000000004760000-0x0000000004809000-memory.dmp
memory/5008-100-0x0000000005360000-0x00000000053E6000-memory.dmp
memory/5008-84-0x0000000002D20000-0x0000000002E41000-memory.dmp
memory/5008-102-0x00000000054E0000-0x0000000005510000-memory.dmp
memory/5008-103-0x0000000005520000-0x000000000555F000-memory.dmp
memory/5008-104-0x0000000005570000-0x000000000559D000-memory.dmp
memory/5008-91-0x0000000004A30000-0x0000000004AA4000-memory.dmp
memory/5008-66-0x0000000002760000-0x00000000029F8000-memory.dmp
memory/5008-106-0x0000000005840000-0x0000000005853000-memory.dmp
memory/5008-107-0x0000000005A70000-0x0000000005A7A000-memory.dmp
memory/5008-98-0x0000000005220000-0x0000000005340000-memory.dmp
memory/5008-101-0x0000000005400000-0x00000000054C4000-memory.dmp
memory/5008-105-0x00000000056C0000-0x0000000005836000-memory.dmp
memory/5008-87-0x00000000046A0000-0x0000000004752000-memory.dmp
memory/5008-85-0x0000000003060000-0x000000000308F000-memory.dmp
memory/5008-86-0x0000000004670000-0x0000000004696000-memory.dmp
memory/5008-77-0x0000000001AA0000-0x0000000001B43000-memory.dmp
memory/5008-75-0x0000000001820000-0x00000000018B9000-memory.dmp
memory/5008-73-0x0000000000E60000-0x0000000000F27000-memory.dmp
memory/5008-72-0x0000000002760000-0x00000000029F8000-memory.dmp
memory/5008-71-0x0000000002760000-0x00000000029F8000-memory.dmp
memory/5040-108-0x000001B77F0F0000-0x000001B77FA9A000-memory.dmp