vidar | 9356506457dc510ea9bb2743be661106573beb605dc6127bbf0a82b524eb8c88

Analysis

max time kernel
122s
max time network
161s
platform
windows7_x64
resource
win7-en-20211208
submitted
15-02-2022 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9356506457dc510ea9bb2743be661106573beb605dc6127bbf0a82b524eb8c88.exe
Size

3.6MB
MD5

81a66564a1a5c2c2b7189681326804aa
SHA1

ac5e9117eea3f03baaf261125492610ec0bbdeb8
SHA256

9356506457dc510ea9bb2743be661106573beb605dc6127bbf0a82b524eb8c88
SHA512

e445e8a7f61353036ffb8c0b38efb5945411b6c7ff58f7920aa6b9328616da5f1fc87894c6ddf301eaec1226c5ca766d7aaabe3bbe7de4fb6a0a3356e8b513ec

Score

10^/10

vidar 932 stealer vmprotect

Malware Config

Extracted

Family

vidar

Version

48.1

Botnet

932

https://koyu.space/@rspich

Attributes

profile_id
932

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1932-56-0x0000000000400000-0x0000000000AF7000-memory.dmp	family_vidar

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1932-56-0x0000000000400000-0x0000000000AF7000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

964 1932 WerFault.exe 9356506457dc510ea9bb2743be661106573beb605dc6127bbf0a82b524eb8c88.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

964 WerFault.exe
964 WerFault.exe
964 WerFault.exe
964 WerFault.exe
964 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 964 WerFault.exe

pid	pid_target	process	target process
964	1932	WerFault.exe	9356506457dc510ea9bb2743be661106573beb605dc6127bbf0a82b524eb8c88.exe

pid	process
964	WerFault.exe
964	WerFault.exe
964	WerFault.exe
964	WerFault.exe
964	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	964	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9356506457dc510ea9bb2743be661106573beb605dc6127bbf0a82b524eb8c88.exe

description	pid	process	target process
PID 1932 wrote to memory of 964	1932	9356506457dc510ea9bb2743be661106573beb605dc6127bbf0a82b524eb8c88.exe	WerFault.exe
PID 1932 wrote to memory of 964	1932	9356506457dc510ea9bb2743be661106573beb605dc6127bbf0a82b524eb8c88.exe	WerFault.exe
PID 1932 wrote to memory of 964	1932	9356506457dc510ea9bb2743be661106573beb605dc6127bbf0a82b524eb8c88.exe	WerFault.exe
PID 1932 wrote to memory of 964	1932	9356506457dc510ea9bb2743be661106573beb605dc6127bbf0a82b524eb8c88.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9356506457dc510ea9bb2743be661106573beb605dc6127bbf0a82b524eb8c88.exe
"C:\Users\Admin\AppData\Local\Temp\9356506457dc510ea9bb2743be661106573beb605dc6127bbf0a82b524eb8c88.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 1300
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-59-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/1932-55-0x0000000076511000-0x0000000076513000-memory.dmp

Filesize
8KB

Download
memory/1932-56-0x0000000000400000-0x0000000000AF7000-memory.dmp

Filesize
7.0MB

Download