vidar | 024b3508e9c9013bc2c8f6f6b81441677cbedabad91ec6c545ef6deee6799eb8 | Triage

Analysis

max time kernel
187s
max time network
226s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
28-05-2022 05:21

Sharing

Report Analysis Logs

General

Target

024b3508e9c9013bc2c8f6f6b81441677cbedabad91ec6c545ef6deee6799eb8.exe
Size

694KB
MD5

4d0196fa739c1085b438da322c97390f
SHA1

e39239052213e842d4fdccbbe6ad4afd9fce2788
SHA256

024b3508e9c9013bc2c8f6f6b81441677cbedabad91ec6c545ef6deee6799eb8
SHA512

d7f1adcaf1493817bb3d48e1a4cd499fe8871ba289b8a3ac3265c65d3f45c47055fcfc08e32e77027301b0f5e7c2557358898a626b38181cd5def04ee8dfb288

Score

10^/10

vidar 933 stealer

Malware Config

Extracted

Family

vidar

Version

41.5

Botnet

933

C2

https://mas.to/@xeroxxx

Attributes

profile_id
933

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1612-131-0x0000000004C20000-0x0000000004CF6000-memory.dmp	family_vidar
behavioral2/memory/1612-132-0x0000000000400000-0x0000000002F74000-memory.dmp	family_vidar
behavioral2/memory/1612-133-0x0000000000400000-0x0000000002F74000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5108 1612 WerFault.exe 024b3508e9c9013bc2c8f6f6b81441677cbedabad91ec6c545ef6deee6799eb8.exe

C:\Users\Admin\AppData\Local\Temp\024b3508e9c9013bc2c8f6f6b81441677cbedabad91ec6c545ef6deee6799eb8.exe
"C:\Users\Admin\AppData\Local\Temp\024b3508e9c9013bc2c8f6f6b81441677cbedabad91ec6c545ef6deee6799eb8.exe"
1⤵
PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 1316
2⤵
- Program crash
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1612 -ip 1612
1⤵
PID:3656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-130-0x0000000004B80000-0x0000000004BFC000-memory.dmp

Filesize
496KB

Download
memory/1612-131-0x0000000004C20000-0x0000000004CF6000-memory.dmp

Filesize
856KB

Download
memory/1612-132-0x0000000000400000-0x0000000002F74000-memory.dmp

Filesize
43.5MB

Download
memory/1612-133-0x0000000000400000-0x0000000002F74000-memory.dmp

Filesize
43.5MB

Download