vidar | 2214bdc78b558176a17484bcc02079a5470e0b49073d50d19b522d67dc4396e3

Analysis

max time kernel
17s
max time network
126s
platform
windows10_x64
resource
win10v20210408
submitted
30-07-2021 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
Size

2.2MB
MD5

4b367c52435f4a834d04797267f84240
SHA1

0cfe62030093baf55769d3d33f024ffdde5417b3
SHA256

8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0
SHA512

a520b430f686b073d744f262411395231bab5093ea0c95d6fe6400ce1d761cb443b43ec8999f12926186f72cfcba371c2b44c9c3ff09125009e90633bafdd598

Score

10^/10

vidar 921 stealer

Malware Config

Extracted

Family

vidar

Version

39.6

Botnet

921

https://sslamlssa1.tumblr.com/

Attributes

profile_id
921

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral31/memory/2584-119-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral31/memory/2584-120-0x000000000046B76D-mapping.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe

description	pid	process	target process
PID 3492 set thread context of 2584	3492	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1136 2584 WerFault.exe 8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe

pid	pid_target	process	target process
1136	2584	WerFault.exe	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe

description	pid	process	target process
PID 3492 wrote to memory of 3776	3492	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
PID 3492 wrote to memory of 3776	3492	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
PID 3492 wrote to memory of 3776	3492	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
PID 3492 wrote to memory of 2584	3492	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
PID 3492 wrote to memory of 2584	3492	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
PID 3492 wrote to memory of 2584	3492	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
PID 3492 wrote to memory of 2584	3492	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
PID 3492 wrote to memory of 2584	3492	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
PID 3492 wrote to memory of 2584	3492	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
PID 3492 wrote to memory of 2584	3492	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
PID 3492 wrote to memory of 2584	3492	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe	8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe

C:\Users\Admin\AppData\Local\Temp\8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
"C:\Users\Admin\AppData\Local\Temp\8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3492

C:\Users\Admin\AppData\Local\Temp\8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
C:\Users\Admin\AppData\Local\Temp\8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
2⤵
PID:3776

C:\Users\Admin\AppData\Local\Temp\8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
C:\Users\Admin\AppData\Local\Temp\8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
2⤵
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 24
3⤵
- Program crash
PID:1136

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2584-119-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2584-120-0x000000000046B76D-mapping.dmp

Download
memory/3492-114-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/3492-116-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/3492-117-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/3492-118-0x0000000004D70000-0x0000000004DE6000-memory.dmp

Filesize
472KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads