vidar | 5b0571f8a88305984bc085c613c36bd12c8ba7539b1429e7302808c228ed89f0

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30-06-2023 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

data64_3.exe
Size

364KB
MD5

849a5ce45c4c4d6ff905454cb4def6d0
SHA1

e7a108de4f5bc1d4df02a54f7feab3bd7fe07540
SHA256

5b0571f8a88305984bc085c613c36bd12c8ba7539b1429e7302808c228ed89f0
SHA512

e7d39db1c07c5aabfda5882e745e27fe8e13bc21b3d851428831fe37cc615d67f48fa2d793d93ba3a8eef1e275499eecd6fb7a2d68bfebcbe6818461bd2548de
SSDEEP

6144:Gr2BjzIgdCCsdNXH/Fopo+CFLbyoSfl8NSoA4XvF1RNhfgs:GMST9GOLmJfl9o9X9Xss

Score

10^/10

vidar 1680 stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

1680

https://t.me/truewallets

https://mas.to/@zara99

http://116.203.10.3:80

Attributes

profile_id
1680

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Suspicious use of SetThreadContext 1 IoCs

Processes:

data64_3.exe

description pid process target process

PID 1668 set thread context of 1616 1668 data64_3.exe data64_3.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

584 1616 WerFault.exe data64_3.exe

description	pid	process	target process
PID 1668 set thread context of 1616	1668	data64_3.exe	data64_3.exe

pid	pid_target	process	target process
584	1616	WerFault.exe	data64_3.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

data64_3.exedata64_3.exe

description	pid	process	target process
PID 1668 wrote to memory of 1616	1668	data64_3.exe	data64_3.exe
PID 1668 wrote to memory of 1616	1668	data64_3.exe	data64_3.exe
PID 1668 wrote to memory of 1616	1668	data64_3.exe	data64_3.exe
PID 1668 wrote to memory of 1616	1668	data64_3.exe	data64_3.exe
PID 1668 wrote to memory of 1616	1668	data64_3.exe	data64_3.exe
PID 1668 wrote to memory of 1616	1668	data64_3.exe	data64_3.exe
PID 1668 wrote to memory of 1616	1668	data64_3.exe	data64_3.exe
PID 1668 wrote to memory of 1616	1668	data64_3.exe	data64_3.exe
PID 1668 wrote to memory of 1616	1668	data64_3.exe	data64_3.exe
PID 1668 wrote to memory of 1616	1668	data64_3.exe	data64_3.exe
PID 1616 wrote to memory of 584	1616	data64_3.exe	WerFault.exe
PID 1616 wrote to memory of 584	1616	data64_3.exe	WerFault.exe
PID 1616 wrote to memory of 584	1616	data64_3.exe	WerFault.exe
PID 1616 wrote to memory of 584	1616	data64_3.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\data64_3.exe
"C:\Users\Admin\AppData\Local\Temp\data64_3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\data64_3.exe
"C:\Users\Admin\AppData\Local\Temp\data64_3.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 116
3⤵
- Program crash
PID:584

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1616-55-0x0000000000070000-0x00000000000D9000-memory.dmp

Filesize
420KB

Download
memory/1616-56-0x0000000000070000-0x00000000000D9000-memory.dmp

Filesize
420KB

Download
memory/1616-60-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1616-59-0x0000000000070000-0x00000000000D9000-memory.dmp

Filesize
420KB

Download
memory/1616-61-0x0000000000070000-0x00000000000D9000-memory.dmp

Filesize
420KB

Download
memory/1616-65-0x0000000000070000-0x00000000000D9000-memory.dmp

Filesize
420KB

Download
memory/1616-58-0x0000000000070000-0x00000000000D9000-memory.dmp

Filesize
420KB

Download
memory/1616-57-0x0000000000070000-0x00000000000D9000-memory.dmp

Filesize
420KB

Download
memory/1616-68-0x0000000000070000-0x00000000000D9000-memory.dmp

Filesize
420KB

Download
memory/1668-54-0x00000000009C0000-0x0000000000A1F000-memory.dmp

Filesize
380KB

Download