vidar | 26285efdd77665c7dd35aa0450f77214644ebb80fb284e071e67f728881c8983 | Triage

Analysis

max time kernel
22s
max time network
40s
platform
windows7_x64
resource
win7v20210408
submitted
04-08-2021 19:13

Sharing

Report Analysis Logs

General

Target

1e981e240cc21580c970db894934da5f.exe
Size

800KB
MD5

1e981e240cc21580c970db894934da5f
SHA1

24bc2e53f10324268b5ba1542568d9e998a1052b
SHA256

26285efdd77665c7dd35aa0450f77214644ebb80fb284e071e67f728881c8983
SHA512

24c9968c7fbe3f341801e723be26dc083939238a94234374e1eb7821360119e6c8efdcd481ab68de2007fcae1a39b897f4b1198cc43a965577a0982272413844

Score

10^/10

vidar 921 stealer

Malware Config

Extracted

Family

vidar

Version

39.9

Botnet

921

C2

https://prophefliloc.tumblr.com/

Attributes

profile_id
921

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/760-64-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

1e981e240cc21580c970db894934da5f.exe

description pid process target process

PID 1292 set thread context of 760 1292 1e981e240cc21580c970db894934da5f.exe 1e981e240cc21580c970db894934da5f.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1e981e240cc21580c970db894934da5f.exe

description pid process

Token: SeDebugPrivilege 1292 1e981e240cc21580c970db894934da5f.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

1e981e240cc21580c970db894934da5f.exe

description	pid	process	target process
PID 1292 wrote to memory of 524	1292	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1292 wrote to memory of 524	1292	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1292 wrote to memory of 524	1292	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1292 wrote to memory of 524	1292	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1292 wrote to memory of 320	1292	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1292 wrote to memory of 320	1292	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1292 wrote to memory of 320	1292	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1292 wrote to memory of 320	1292	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1292 wrote to memory of 760	1292	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1292 wrote to memory of 760	1292	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1292 wrote to memory of 760	1292	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1292 wrote to memory of 760	1292	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1292 wrote to memory of 760	1292	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1292 wrote to memory of 760	1292	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1292 wrote to memory of 760	1292	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1292 wrote to memory of 760	1292	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1292 wrote to memory of 760	1292	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe

C:\Users\Admin\AppData\Local\Temp\1e981e240cc21580c970db894934da5f.exe
"C:\Users\Admin\AppData\Local\Temp\1e981e240cc21580c970db894934da5f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292

C:\Users\Admin\AppData\Local\Temp\1e981e240cc21580c970db894934da5f.exe
C:\Users\Admin\AppData\Local\Temp\1e981e240cc21580c970db894934da5f.exe
2⤵
PID:524

C:\Users\Admin\AppData\Local\Temp\1e981e240cc21580c970db894934da5f.exe
C:\Users\Admin\AppData\Local\Temp\1e981e240cc21580c970db894934da5f.exe
2⤵
PID:320

C:\Users\Admin\AppData\Local\Temp\1e981e240cc21580c970db894934da5f.exe
C:\Users\Admin\AppData\Local\Temp\1e981e240cc21580c970db894934da5f.exe
2⤵
PID:760

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/760-64-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/760-65-0x000000000046B77D-mapping.dmp

Download
memory/1292-60-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/1292-62-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download
memory/1292-63-0x0000000000750000-0x0000000000771000-memory.dmp

Filesize
132KB

Download