vidar | 627a4b4c4b74f987b4d9438b90a9f064fdc8f1b9b2f1e108fed555cad1ba795a

Analysis

max time kernel
37s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/01/2023, 20:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

687.1MB
MD5

9d0258317b5a7ae904e5aeae555c0d2c
SHA1

0ff16422c69a3fbe940240f045cdf92f721f6812
SHA256

7a3579661b4a78ef73563662fed3193d6277e124562b6bff4c65130948668ed5
SHA512

a0fc9ee65e2af5615a6b7d395892ece497ecddc3c76aae80b5a0a1339c195a70db5e90cbda8bf2085b17666ca090bfff43318d97c06a9614663c9f3cea715c7c
SSDEEP

12288:vCrqs5Gqd60s/HB2y0MKGqDqrNT8w5wREicnFBgudACq5:vDUxw2kqkTOudAD

Score

10^/10

vidar 713 stealer

Malware Config

Extracted

Family

vidar

Version

1.8

Botnet

713

https://t.me/year2023start

https://steamcommunity.com/profiles/76561199467421923

Attributes

profile_id
713

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1944 set thread context of 1916	1944	setup.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1000	1944	WerFault.exe	27

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1916	1944	setup.exe	29
PID 1944 wrote to memory of 1916	1944	setup.exe	29
PID 1944 wrote to memory of 1916	1944	setup.exe	29
PID 1944 wrote to memory of 1916	1944	setup.exe	29
PID 1944 wrote to memory of 1916	1944	setup.exe	29
PID 1944 wrote to memory of 1916	1944	setup.exe	29
PID 1944 wrote to memory of 1916	1944	setup.exe	29
PID 1944 wrote to memory of 1916	1944	setup.exe	29
PID 1944 wrote to memory of 1916	1944	setup.exe	29
PID 1944 wrote to memory of 1000	1944	setup.exe	30
PID 1944 wrote to memory of 1000	1944	setup.exe	30
PID 1944 wrote to memory of 1000	1944	setup.exe	30
PID 1944 wrote to memory of 1000	1944	setup.exe	30
PID 1944 wrote to memory of 1000	1944	setup.exe	30
PID 1944 wrote to memory of 1000	1944	setup.exe	30
PID 1944 wrote to memory of 1000	1944	setup.exe	30

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 36
  2⤵
  - Program crash
  PID:1000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1916-55-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1916-57-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1916-64-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1916-66-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1944-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1944-68-0x00000000001B0000-0x000000000022A000-memory.dmp

Filesize
488KB

Download