vidar | 2b106f99fd8c508e41db0a675af9bad1151ce0ff026e08edf020be44f17a072c | Triage

Analysis

max time kernel
154s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
15-06-2022 03:30

Sharing

Report Analysis Logs

General

Target

2b106f99fd8c508e41db0a675af9bad1151ce0ff026e08edf020be44f17a072c.exe
Size

695KB
MD5

e92e8dcc342db6f2c13054d308870b55
SHA1

aea49d54350bbb6f2699006d274413e035a0adfc
SHA256

2b106f99fd8c508e41db0a675af9bad1151ce0ff026e08edf020be44f17a072c
SHA512

12d5d14c966b4ec9fe451035bd9d0d24df5f31c2711c8b098aabe45d01adae639463f11c9bcb1431b8191394e6f6ca86502365a2ad4272cbd77dcc78c043ff62

Score

10^/10

vidar 937 stealer

Malware Config

Extracted

Family

vidar

Version

41.5

Botnet

937

C2

https://mas.to/@xeroxxx

Attributes

profile_id
937

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/440-131-0x0000000004D60000-0x0000000004E36000-memory.dmp	family_vidar
behavioral2/memory/440-132-0x0000000000400000-0x0000000002F74000-memory.dmp	family_vidar
behavioral2/memory/440-133-0x0000000000400000-0x0000000002F74000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2684 440 WerFault.exe 2b106f99fd8c508e41db0a675af9bad1151ce0ff026e08edf020be44f17a072c.exe

C:\Users\Admin\AppData\Local\Temp\2b106f99fd8c508e41db0a675af9bad1151ce0ff026e08edf020be44f17a072c.exe
"C:\Users\Admin\AppData\Local\Temp\2b106f99fd8c508e41db0a675af9bad1151ce0ff026e08edf020be44f17a072c.exe"
1⤵
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 1308
2⤵
- Program crash
PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 440 -ip 440
1⤵
PID:5072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/440-130-0x0000000004C10000-0x0000000004C8C000-memory.dmp

Filesize
496KB

Download
memory/440-131-0x0000000004D60000-0x0000000004E36000-memory.dmp

Filesize
856KB

Download
memory/440-132-0x0000000000400000-0x0000000002F74000-memory.dmp

Filesize
43.5MB

Download
memory/440-133-0x0000000000400000-0x0000000002F74000-memory.dmp

Filesize
43.5MB

Download