vidar | 9fefd930a1cc7b257fe5a65bc3eda3167bc0f82895f288fc34eaca3411b2688b

Analysis

max time kernel
119s
max time network
117s
platform
windows7_x64
resource
win7-en-20210920
submitted
14/10/2021, 11:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ba17abec06b76fed7a1ae673e052f767.exe
Size 667KB
Sample211014-nmqppaghgl
SHA256 9fefd930a1cc7b257fe5a65bc3eda3167bc0f82895f288fc34eaca3411b2688b
MD5 ba17abec06b76fed7a1ae673e052f767
SHA1 0690d4700be00ef41d0d2934756fdae56dd01772
SHA512 b25428c89ee8c2b38a5fdb685790e02bca24b22b654637fa191bf0a55b8a76d466bbcfdc65affb55c0c64bfebbed0709250e44be4e88b722d31bd65acb7b7ed2
MD5 SHA1 SHA512

Score

10^/10

vidar 1008 stealer

Malware Config

Extracted

Family

vidar

Version

41.3

Botnet

1008

https://mas.to/@oleg98

Attributes

profile_id
1008

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/2040-56-0x0000000000220000-0x00000000002F6000-memory.dmp	family_vidar
behavioral1/memory/2040-57-0x0000000000400000-0x0000000000518000-memory.dmp	family_vidar

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1128	2040	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1128	WerFault.exe
1128	WerFault.exe
1128	WerFault.exe
1128	WerFault.exe
1128	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1128	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1128	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1128	2040	ba17abec06b76fed7a1ae673e052f767.exe	29
PID 2040 wrote to memory of 1128	2040	ba17abec06b76fed7a1ae673e052f767.exe	29
PID 2040 wrote to memory of 1128	2040	ba17abec06b76fed7a1ae673e052f767.exe	29
PID 2040 wrote to memory of 1128	2040	ba17abec06b76fed7a1ae673e052f767.exe	29

C:\Users\Admin\AppData\Local\Temp\ba17abec06b76fed7a1ae673e052f767.exe
"C:\Users\Admin\AppData\Local\Temp\ba17abec06b76fed7a1ae673e052f767.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 872
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1128-59-0x00000000003E0000-0x0000000000440000-memory.dmp

Download

memory/2040-54-0x00000000006B8000-0x0000000000735000-memory.dmp

Download

memory/2040-55-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Download

memory/2040-56-0x0000000000220000-0x00000000002F6000-memory.dmp

Download

memory/2040-57-0x0000000000400000-0x0000000000518000-memory.dmp

Download