LevelBlue Details AutoIt Loader Chain Linked to Vidar Stealer
Summary
LevelBlue traced a Windows infection chain from MicrosoftToolkit.exe through a disguised script and AutoIt loader to communications associated with Vidar. The analysis found anti-analysis and cleanup behavior; credential theft was a potential outcome, not confirmed.
Key points
- LevelBlue’s endpoint telemetry and dynamic analysis traced execution from MicrosoftToolkit.exe through cmd.exe and a renamed .dot file executed as a batch script.
- The chain used extract32.exe to stage a payload, then ran the AutoIt-compiled Replies.scr loader with an external payload file.
- Replies.scr made HTTP GET requests to telegram[.]me and steamcommunity[.]com; DNS activity also involved gz[.]technicalprorj[.]xyz. LevelBlue associated the activity with Vidar infrastructure.
- Analysis observed debugger and instrumentation-callback checks, process discovery, and deletion of staged files and other artifacts.
- The observed communications and loader behavior indicated Vidar deployment, but the article describes credential and browser-data theft as likely rather than confirming stolen data.
- LevelBlue recommends isolating affected systems, reimaging them, resetting potentially exposed credentials, enforcing MFA, and monitoring suspicious DNS and outbound traffic.
Article Details
- Attack Vectors
- The infection began when a user executed MicrosoftToolkit.exe, which spawned cmd.exe.
- A disguised .dot file was renamed to a .bat file and executed to stage further activity.
- The chain used tasklist and findstr for process discovery, then extract32.exe to unpack payload components.
- Replies.scr, an AutoIt-compiled loader, processed an external payload file named D and initiated network communication.
- Defensive Notes
- Isolate affected systems, reimage them, and reset potentially compromised credentials and invalidate active sessions.
- Enforce multi-factor authentication and monitor DNS and outbound traffic for suspicious connections, including newly registered or uncommon domains.
- Restrict execution of unauthorized or untrusted tools; enable Application Control and the recommended LevelBlue Behavioral Execution Prevention protections.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | gz[.]technicalprorj[.]xyz | Vidar-associated C2 domain; the article reports DNS resolution for it before outbound communication. |
| IPV4 | 149[.]154[.]167[.]99 | Vidar-associated C2 IP address listed in the article. |
| SHA256 | 881619a47b62b52305d92640cc4d4845a279c23a5a749413785fc8fcb0fdf7fb | SHA-256 hash listed for replies.scr, the AutoIt loader used in the infection chain. |
| SHA256 | 968ecf51c442ec0ff91f91689ac524e7e8e9eab0c1a2a65cf13e54cf95194efe | SHA-256 hash listed for D, the external payload file processed by the loader. |
| SHA256 | 978ad86c90d85b74947bb627ec24f8bcd26812b500e82f5af202160506ac29c6 | SHA-256 hash listed among samples and staged payloads in the infection chain. |
| SHA256 | d4fe9f48178cdf375a3be30d17f1dc016b5861dff8683f0bb35a0ba8d44f892f | SHA-256 hash listed among samples and staged payloads in the infection chain. |
| SHA256 | fc27479ff929d846e7c5c5d147479c81e483a2ec911bd1501a53aa646a29620d | SHA-256 hash listed for MicrosoftToolkit.exe, the executable that initiated the infection chain. |
| URL | hxxps[:]//telegram[.]me/sre22qe | Specific request target used by the malware for C2 communication or retrieval of configuration or staging information. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes .dot files as containers likely hiding encoded or segmented payload data.T1036 · MasqueradingThe Swingers.dot file was renamed to swingers.dot.bat and executed, disguising its original file type.T1041 · Exfiltration Over C2 ChannelThe article describes likely exfiltration of credentials and browser data over the Vidar-associated C2 path; exfiltration is presented as likely, not confirmed.T1057 · Process DiscoveryThe chain used tasklist and findstr to enumerate running processes and identify security-related processes.T1059.003 · Windows Command ShellMicrosoftToolkit.exe spawned cmd.exe, and batch/script commands were used to stage further execution.T1059.010 · AutoHotKey & AutoITThe AutoIt-compiled Replies.scr loader processed an external payload file and executed malicious logic.T1070.004 · File DeletionThe malware deleted dropped and staged files, including .dot payload files, during cleanup.T1071.001 · Web ProtocolsThe malware used WinINet HTTP requests to communicate with remote endpoints, including the reported Telegram request target.T1140 · Deobfuscate/Decode Files or Informationextract32.exe was used to unpack the next-stage payload.T1204.002 · Malicious FileThe infection began after a user downloaded and executed MicrosoftToolkit.exe.T1562.001 · Disable or Modify ToolsThe article reports attempts to identify and potentially terminate security-related processes before payload deployment.T1573 · Encrypted ChannelThe reported C2 request used HTTPS.T1622 · Debugger EvasionVidar queried process debug attributes using ZwQueryInformationProcess to detect a debugger and alter execution.
Malware
Vendors
Tools
AutoItLevelBlue analyzed a multi-stage infection chain that started with MicrosoftToolkit.exe, used script masquerading and AutoIt-based staging, and ended with communication tied to Vidar infrastructure.extract32.exePayload extraction was performed with extract32.exe, followed by execution of the AutoIt loader Replies.scr with an external argument.MicrosoftToolkit.exeLevelBlue analyzed a multi-stage infection chain that started with MicrosoftToolkit.exe, used script masquerading and AutoIt-based staging, and ended with communication tied to Vidar infrastructure.x64dbgAs soon as we load and run the extracted executable payload into x64dbg, we get the following message.