vidar | d6ff71f4320761a9d08e753f0fe917ff018df8000405f1e789ce2f20dd22bc76

General

Target
3c2acafef30f0868587e5dfd2fe6f123.exe
Size 518KB
Sample210706-27ac6q2qvs
SHA256 d6ff71f4320761a9d08e753f0fe917ff018df8000405f1e789ce2f20dd22bc76
MD5 3c2acafef30f0868587e5dfd2fe6f123
SHA1 7390fa754b251c24620c43337f45c5488eaf372f
SHA512 dc3bd0b2b6e264743e89c777c35dd2e5f91f8f3031516a9cb5e3dc62cbd06ee4b15f15b343572d68ef0f8d7175f4e48eae4eb7a77ae71a41973b973c18b61edc
MD5 SHA1 SHA512

Score

10^/10

vidar stealer

Malware Config

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Core1 .NET packer 1 IoCs

Detects packer/loader used by .NET malware.

resource	yara_rule
behavioral2/memory/1908-119-0x000000001C940000-0x000000001C9F4000-memory.dmp	Core1

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/1908-119-0x000000001C940000-0x000000001C9F4000-memory.dmp	family_vidar
behavioral2/memory/1908-122-0x000000001D6A0000-0x000000001D73C000-memory.dmp	family_vidar

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1908	3c2acafef30f0868587e5dfd2fe6f123.exe
1908	3c2acafef30f0868587e5dfd2fe6f123.exe
1908	3c2acafef30f0868587e5dfd2fe6f123.exe
1908	3c2acafef30f0868587e5dfd2fe6f123.exe
1908	3c2acafef30f0868587e5dfd2fe6f123.exe
1908	3c2acafef30f0868587e5dfd2fe6f123.exe
1908	3c2acafef30f0868587e5dfd2fe6f123.exe
1908	3c2acafef30f0868587e5dfd2fe6f123.exe
1908	3c2acafef30f0868587e5dfd2fe6f123.exe
1908	3c2acafef30f0868587e5dfd2fe6f123.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	3c2acafef30f0868587e5dfd2fe6f123.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 188	1908	3c2acafef30f0868587e5dfd2fe6f123.exe	76
PID 1908 wrote to memory of 188	1908	3c2acafef30f0868587e5dfd2fe6f123.exe	76
PID 1908 wrote to memory of 188	1908	3c2acafef30f0868587e5dfd2fe6f123.exe	76
PID 1908 wrote to memory of 212	1908	3c2acafef30f0868587e5dfd2fe6f123.exe	77
PID 1908 wrote to memory of 212	1908	3c2acafef30f0868587e5dfd2fe6f123.exe	77
PID 1908 wrote to memory of 212	1908	3c2acafef30f0868587e5dfd2fe6f123.exe	77
PID 1908 wrote to memory of 204	1908	3c2acafef30f0868587e5dfd2fe6f123.exe	78
PID 1908 wrote to memory of 204	1908	3c2acafef30f0868587e5dfd2fe6f123.exe	78
PID 1908 wrote to memory of 204	1908	3c2acafef30f0868587e5dfd2fe6f123.exe	78
PID 1908 wrote to memory of 196	1908	3c2acafef30f0868587e5dfd2fe6f123.exe	79
PID 1908 wrote to memory of 196	1908	3c2acafef30f0868587e5dfd2fe6f123.exe	79
PID 1908 wrote to memory of 196	1908	3c2acafef30f0868587e5dfd2fe6f123.exe	79
PID 1908 wrote to memory of 2200	1908	3c2acafef30f0868587e5dfd2fe6f123.exe	80
PID 1908 wrote to memory of 2200	1908	3c2acafef30f0868587e5dfd2fe6f123.exe	80
PID 1908 wrote to memory of 2200	1908	3c2acafef30f0868587e5dfd2fe6f123.exe	80

C:\Users\Admin\AppData\Local\Temp\3c2acafef30f0868587e5dfd2fe6f123.exe
"C:\Users\Admin\AppData\Local\Temp\3c2acafef30f0868587e5dfd2fe6f123.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  PID:188
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  PID:212
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  PID:204
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  PID:196
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1908-114-0x0000000000D90000-0x0000000000D91000-memory.dmp

Download

memory/1908-116-0x000000001C440000-0x000000001C530000-memory.dmp

Download

memory/1908-117-0x000000001CA90000-0x000000001CA92000-memory.dmp

Download

memory/1908-118-0x000000001D870000-0x000000001D871000-memory.dmp

Download

memory/1908-119-0x000000001C940000-0x000000001C9F4000-memory.dmp

Download

memory/1908-120-0x0000000001680000-0x0000000001690000-memory.dmp

Download

memory/1908-121-0x0000000001790000-0x0000000001791000-memory.dmp

Download

memory/1908-122-0x000000001D6A0000-0x000000001D73C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads