vidar | 3a95e1c2c599e7c27537e42713451e862dcd318660bbc11bbb45f1432f68499c

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mpclient.dll
Size 2.2MB
Sample261107-c8rnbsas7p
SHA256 3a95e1c2c599e7c27537e42713451e862dcd318660bbc11bbb45f1432f68499c
MD5 fcfda692c84f930191c2b8b1adbcddb9
SHA1 cda8edd09090da67fc542a4f839135fc156363f0
SHA512 1cfeed102d75e4c7849e3954e2f57cec3719c319149c134d4921dd8e3d4ffef782285bc1496ca0f6680c197881ef5737b0aee4e562aca7a78b65da7cb0b014e2
SSDEEP 49152:WxurMreHHztGyjwxm/pzVuSI5wy+PYN633OlSR9mTeQi+O3d82AUsa:WAnj+0sa
TLSH
T1F0B58C0AACD008B6D46A53328CB752927B39F8180B7327D72E26A7782FF2BD05D75744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ef045f18455132bc2e22c24a3c41c8a9 defense_evasion discovery vidar spyware stealer trojan

Malware Config

Extracted

Family

vidar

Version

Botnet

ef045f18455132bc2e22c24a3c41c8a9

https://168.222.97.79
https://telegram.me/nwwfh8
https://steamcommunity.com/profiles/76561198719385745

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral9/memory/956-1-0x0000000140000000-0x0000000140105000-memory.dmp	family_vidar_v15
behavioral9/memory/956-23-0x0000000140000000-0x0000000140105000-memory.dmp	family_vidar_v15

Badlisted process makes network request 64 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	956	rundll32.exe
14	956	rundll32.exe
16	956	rundll32.exe
17	956	rundll32.exe
20	956	rundll32.exe
22	956	rundll32.exe
24	956	rundll32.exe
25	956	rundll32.exe
27	956	rundll32.exe
29	956	rundll32.exe
31	956	rundll32.exe
33	956	rundll32.exe
35	956	rundll32.exe
39	956	rundll32.exe
40	956	rundll32.exe
41	956	rundll32.exe
42	956	rundll32.exe
43	956	rundll32.exe
57	956	rundll32.exe
58	956	rundll32.exe
59	956	rundll32.exe
60	956	rundll32.exe
61	956	rundll32.exe
63	956	rundll32.exe
64	956	rundll32.exe
65	956	rundll32.exe
66	956	rundll32.exe
67	956	rundll32.exe
68	956	rundll32.exe
69	956	rundll32.exe
72	956	rundll32.exe
73	956	rundll32.exe
74	956	rundll32.exe
78	956	rundll32.exe
79	956	rundll32.exe
80	956	rundll32.exe
81	956	rundll32.exe
82	956	rundll32.exe
84	956	rundll32.exe
85	956	rundll32.exe
86	956	rundll32.exe
87	956	rundll32.exe
88	956	rundll32.exe
90	956	rundll32.exe
91	956	rundll32.exe
92	956	rundll32.exe
93	956	rundll32.exe
94	956	rundll32.exe
96	956	rundll32.exe
97	956	rundll32.exe
98	956	rundll32.exe
99	956	rundll32.exe
100	956	rundll32.exe
102	956	rundll32.exe
103	956	rundll32.exe
104	956	rundll32.exe
105	956	rundll32.exe
106	956	rundll32.exe
107	956	rundll32.exe
108	956	rundll32.exe
109	956	rundll32.exe
110	956	rundll32.exe
111	956	rundll32.exe
113	956	rundll32.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mpclient.dll,#1
1⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
PID:956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-0-0x0000000140000000-0x0000000140105000-memory.dmp

Download

memory/956-1-0x0000000140000000-0x0000000140105000-memory.dmp

Download

memory/956-22-0x00007FFEEC0A0000-0x00007FFEEC2FE000-memory.dmp

Download

memory/956-23-0x0000000140000000-0x0000000140105000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads