Overview
overview
10Static
static
3Bооtsехеc-64.exe
windows10-2004-x64
7Bооtsехеc-64.exe
windows11-ltsc_2024-x64
7locales/re...ng.dll
windows10-2004-x64
1locales/re...ng.dll
windows11-ltsc_2024-x64
1locales/re...ng.dll
windows10-2004-x64
1locales/re...ng.dll
windows11-ltsc_2024-x64
1locales/re...ng.dll
windows10-2004-x64
1locales/re...ng.dll
windows11-ltsc_2024-x64
1mpclient.dll
windows10-2004-x64
10mpclient.dll
windows11-ltsc_2024-x64
10Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 02:44
Static task
static1
Behavioral task
behavioral1
Sample
Bооtsехеc-64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Bооtsехеc-64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
locales/resources/app.asar.unpacked/node_modules/btime/binding.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
locales/resources/app.asar.unpacked/node_modules/btime/binding.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
mpclient.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
mpclient.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target mpclient.dll
- Size 2.2MB
- Sample261107-c8d28sty4n
- SHA256 3a95e1c2c599e7c27537e42713451e862dcd318660bbc11bbb45f1432f68499c
- MD5 fcfda692c84f930191c2b8b1adbcddb9
- SHA1 cda8edd09090da67fc542a4f839135fc156363f0
- SHA512 1cfeed102d75e4c7849e3954e2f57cec3719c319149c134d4921dd8e3d4ffef782285bc1496ca0f6680c197881ef5737b0aee4e562aca7a78b65da7cb0b014e2
- SSDEEP 49152:WxurMreHHztGyjwxm/pzVuSI5wy+PYN633OlSR9mTeQi+O3d82AUsa:WAnj+0sa
- TLSH T1F0B58C0AACD008B6D46A53328CB752927B39F8180B7327D72E26A7782FF2BD05D75744
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
-
vidar
-
1.1
-
ef045f18455132bc2e22c24a3c41c8a9
-
https://168.222.97.79
-
https://telegram.me/nwwfh8
-
https://steamcommunity.com/profiles/76561198719385745
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0
Signatures
- Detects Vidar Stealer 2 IoCs
resource yara_rule behavioral10/memory/6072-2-0x0000000140000000-0x0000000140105000-memory.dmp family_vidar_v15 behavioral10/memory/6072-43-0x0000000140000000-0x0000000140105000-memory.dmp family_vidar_v15 - Badlisted process makes network request 64 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 1 6072 rundll32.exe 3 6072 rundll32.exe 4 6072 rundll32.exe 5 6072 rundll32.exe 6 6072 rundll32.exe 7 6072 rundll32.exe 10 6072 rundll32.exe 11 6072 rundll32.exe 12 6072 rundll32.exe 13 6072 rundll32.exe 14 6072 rundll32.exe 15 6072 rundll32.exe 16 6072 rundll32.exe 17 6072 rundll32.exe 22 6072 rundll32.exe 23 6072 rundll32.exe 24 6072 rundll32.exe 25 6072 rundll32.exe 26 6072 rundll32.exe 27 6072 rundll32.exe 28 6072 rundll32.exe 29 6072 rundll32.exe 30 6072 rundll32.exe 31 6072 rundll32.exe 32 6072 rundll32.exe 33 6072 rundll32.exe 34 6072 rundll32.exe 35 6072 rundll32.exe 36 6072 rundll32.exe 37 6072 rundll32.exe 38 6072 rundll32.exe 39 6072 rundll32.exe 40 6072 rundll32.exe 41 6072 rundll32.exe 42 6072 rundll32.exe 44 6072 rundll32.exe 45 6072 rundll32.exe 46 6072 rundll32.exe 47 6072 rundll32.exe 48 6072 rundll32.exe 49 6072 rundll32.exe 50 6072 rundll32.exe 51 6072 rundll32.exe 52 6072 rundll32.exe 53 6072 rundll32.exe 54 6072 rundll32.exe 55 6072 rundll32.exe 56 6072 rundll32.exe 57 6072 rundll32.exe 58 6072 rundll32.exe 59 6072 rundll32.exe 60 6072 rundll32.exe 61 6072 rundll32.exe 62 6072 rundll32.exe 65 6072 rundll32.exe 66 6072 rundll32.exe 67 6072 rundll32.exe 68 6072 rundll32.exe 69 6072 rundll32.exe 70 6072 rundll32.exe 71 6072 rundll32.exe 72 6072 rundll32.exe 73 6072 rundll32.exe 74 6072 rundll32.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rundll32.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c0000000100000004000000000800000f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b19000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\mpclient.dll,#11⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
PID:6072
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2836