vidar | 7cb5a78513c744a0e152d1bbac77df0157253eab90adbfdbc419a5c2f59662be

Analysis

max time kernel
131s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2023, 20:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8bbc17433814e1feb80c361de06a5db9.exe
Size 873KB
Sample231219-yq4e3abed2
SHA256 7cb5a78513c744a0e152d1bbac77df0157253eab90adbfdbc419a5c2f59662be
MD5 8bbc17433814e1feb80c361de06a5db9
SHA1 1d3c273b2f4a8d53cdcd23100b8262f4e5df4650
SHA512 365ef7b331bf3f653a74c2aba8b3afea5e680bedfcf3b3280a0328ad610b2859c7c57e5bfe5e6da8ec9dc9df085a3500d309b0a3d83f977f421af5e6da704c6e
SSDEEP 12288:cLxhqCrfU7SAVbjw5TkS/DhFYb2+56uiLuxMcSAZ1TjVpYX6fAZiQgeqdTAoa6mU:c1hHrg6/DjuieqAv9Qif1aI8OV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar 517 stealer

Malware Config

Extracted

Family

vidar

Version

41.2

Botnet

https://mas.to/@serg4325

Attributes

profile_id
517

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 6 IoCs

stealer

resource	yara_rule
behavioral2/memory/3404-2-0x0000000000DD0000-0x0000000000EA6000-memory.dmp	family_vidar
behavioral2/memory/4292-3-0x0000000000400000-0x00000000004D9000-memory.dmp	family_vidar
behavioral2/memory/4292-4-0x0000000000400000-0x00000000004D9000-memory.dmp	family_vidar
behavioral2/memory/4292-5-0x0000000000400000-0x00000000004D9000-memory.dmp	family_vidar
behavioral2/memory/4292-6-0x0000000000400000-0x00000000004D9000-memory.dmp	family_vidar
behavioral2/memory/4292-10-0x0000000000400000-0x00000000004D9000-memory.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3404 set thread context of 4292	3404	8bbc17433814e1feb80c361de06a5db9.exe	91

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4496	4292	WerFault.exe	91

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4292	3404	8bbc17433814e1feb80c361de06a5db9.exe	91
PID 3404 wrote to memory of 4292	3404	8bbc17433814e1feb80c361de06a5db9.exe	91
PID 3404 wrote to memory of 4292	3404	8bbc17433814e1feb80c361de06a5db9.exe	91
PID 3404 wrote to memory of 4292	3404	8bbc17433814e1feb80c361de06a5db9.exe	91
PID 3404 wrote to memory of 4292	3404	8bbc17433814e1feb80c361de06a5db9.exe	91
PID 3404 wrote to memory of 4292	3404	8bbc17433814e1feb80c361de06a5db9.exe	91
PID 3404 wrote to memory of 4292	3404	8bbc17433814e1feb80c361de06a5db9.exe	91
PID 3404 wrote to memory of 4292	3404	8bbc17433814e1feb80c361de06a5db9.exe	91

C:\Users\Admin\AppData\Local\Temp\8bbc17433814e1feb80c361de06a5db9.exe
"C:\Users\Admin\AppData\Local\Temp\8bbc17433814e1feb80c361de06a5db9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Users\Admin\AppData\Local\Temp\8bbc17433814e1feb80c361de06a5db9.exe
  "C:\Users\Admin\AppData\Local\Temp\8bbc17433814e1feb80c361de06a5db9.exe"
  2⤵
  PID:4292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 1588
    3⤵
    - Program crash
    PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4292 -ip 4292
1⤵
PID:636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3404-1-0x00000000009F0000-0x0000000000AF0000-memory.dmp

Download

memory/3404-2-0x0000000000DD0000-0x0000000000EA6000-memory.dmp

Download

memory/4292-3-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/4292-4-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/4292-5-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/4292-6-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/4292-10-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads