vidar | bc25dd6801d118c88dc693ee7be6bb2369e6127b5fdd3f20a0ae496f034c288c

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-en-20210920
submitted
07/10/2021, 16:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8dd2dc2c39490f74d043bb69d751b8af.exe
Size 666KB
Sample211007-t6lsqschfp
SHA256 bc25dd6801d118c88dc693ee7be6bb2369e6127b5fdd3f20a0ae496f034c288c
MD5 8dd2dc2c39490f74d043bb69d751b8af
SHA1 da48e14a65f1d0ca16cc9b8f0d83df4984907f0b
SHA512 b9d8d1f85d36867911f33adf73f65b403948c132ab7825e32cf2e1a2b986b3686e36a0d9eacb8094c5659d4501f3b43feeac6e00cb1967f10935dbd10821801a
MD5 SHA1 SHA512

Score

10^/10

vidar 1008 stealer

Malware Config

Extracted

Family

vidar

Version

41.2

Botnet

1008

https://mas.to/@serg4325

Attributes

profile_id
1008

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/1128-56-0x0000000000400000-0x00000000008D6000-memory.dmp	family_vidar
behavioral1/memory/1128-55-0x0000000000310000-0x00000000003E6000-memory.dmp	family_vidar

Program crash 1 IoCs

pid	pid_target	Process	procid_target
860	1128	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
860	WerFault.exe
860	WerFault.exe
860	WerFault.exe
860	WerFault.exe
860	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
860	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	860	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 860	1128	8dd2dc2c39490f74d043bb69d751b8af.exe	29
PID 1128 wrote to memory of 860	1128	8dd2dc2c39490f74d043bb69d751b8af.exe	29
PID 1128 wrote to memory of 860	1128	8dd2dc2c39490f74d043bb69d751b8af.exe	29
PID 1128 wrote to memory of 860	1128	8dd2dc2c39490f74d043bb69d751b8af.exe	29

C:\Users\Admin\AppData\Local\Temp\8dd2dc2c39490f74d043bb69d751b8af.exe
"C:\Users\Admin\AppData\Local\Temp\8dd2dc2c39490f74d043bb69d751b8af.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 860
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-58-0x0000000000330000-0x0000000000331000-memory.dmp

Download

memory/1128-53-0x00000000009DB000-0x0000000000A57000-memory.dmp

Download

memory/1128-54-0x0000000074B41000-0x0000000074B43000-memory.dmp

Download

memory/1128-56-0x0000000000400000-0x00000000008D6000-memory.dmp

Download

memory/1128-55-0x0000000000310000-0x00000000003E6000-memory.dmp

Download