vidar | 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa

Analysis

max time kernel
98s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20231201-en
resource tags

arch:x64arch:x86image:win10v2004-20231201-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2023 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe
Size

11.3MB
MD5

98a0bf4af1e1e9a69bddee4421e1772d
SHA1

38c9160650423557c000b624dc5764c7e593b6e2
SHA256

34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa
SHA512

57e5311bc68b22f59029129ed8a11b6e604e908eba60bc4548604011eee2465ffee5748157d78377c796bb6a2e019cd9018f84f4fc610a45255ee4729f1797dc
SSDEEP

196608:Z0OHLe9/L+y5ugST2ZHZIXt/D7awIyOmAJuA4PZPc2iVXLy0LY7tvRo:K39/Cy5ugPnIFb37AJ+Nc2ikQGo

Score

10^/10

vidar ff0f5173b378c3dde7c3c6e3ae14c3a6 stealer

Malware Config

Extracted

Family

vidar

Version

6.5

Botnet

ff0f5173b378c3dde7c3c6e3ae14c3a6

https://t.me/starcofeeth

https://steamcommunity.com/profiles/76561199571056594

Attributes

profile_id_v2
ff0f5173b378c3dde7c3c6e3ae14c3a6
user_agent
Mozilla/5.0 (X11; CrOS x86_64 15329.59.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe

description	pid	process	target process
PID 1544 set thread context of 3580	1544	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4772 3580 WerFault.exe 34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe

pid	pid_target	process	target process
4772	3580	WerFault.exe	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe

description	pid	process	target process
PID 1544 wrote to memory of 3580	1544	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe
PID 1544 wrote to memory of 3580	1544	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe
PID 1544 wrote to memory of 3580	1544	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe
PID 1544 wrote to memory of 3580	1544	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe
PID 1544 wrote to memory of 3580	1544	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe
PID 1544 wrote to memory of 3580	1544	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe
PID 1544 wrote to memory of 3580	1544	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe
PID 1544 wrote to memory of 3580	1544	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe
PID 1544 wrote to memory of 3580	1544	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe	34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe

C:\Users\Admin\AppData\Local\Temp\34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe
"C:\Users\Admin\AppData\Local\Temp\34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1544

C:\Users\Admin\AppData\Local\Temp\34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe
"C:\Users\Admin\AppData\Local\Temp\34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa.exe"
2⤵
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 388
3⤵
- Program crash
PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3580 -ip 3580
1⤵
PID:4316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-0-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/1544-1-0x0000000000670000-0x00000000011BE000-memory.dmp

Filesize
11.3MB

Download
memory/1544-2-0x0000000006120000-0x00000000066C4000-memory.dmp

Filesize
5.6MB

Download
memory/1544-3-0x00000000034F0000-0x0000000003500000-memory.dmp

Filesize
64KB

Download
memory/1544-8-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/3580-4-0x0000000001300000-0x0000000001539000-memory.dmp

Filesize
2.2MB

Download
memory/3580-7-0x0000000001300000-0x0000000001539000-memory.dmp

Filesize
2.2MB

Download
memory/3580-10-0x0000000001300000-0x0000000001539000-memory.dmp

Filesize
2.2MB

Download