vidar | 00deb73a1738a3b3bfd9504b70775d668581f504481c7f37c20831504f9b77aa

Analysis

max time kernel
236s
max time network
324s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

сентябрь 2023(570)/0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe
Size

1.2MB
MD5

432385402013c4f7301767eff3d81929
SHA1

249c107d10b2590bcae805663343723ad8f794bd
SHA256

0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804
SHA512

798e303a2829225c03dbd29634bd5fef5a63e9f1bbf57371d087eeb34715cd096d18e2e34c4c418a44af0954a756fa2c816eb4e9ba56e9aecb95b9133a1d14fd
SSDEEP

24576:V20lhvrCxcONV5EjvWkq9kqpK6dRE1Iu/zu0Gs9W5mq9N1YwmXnEPUozh0gd:Ighvuxccgb1qpK6dRozu0r4NZmX7+Zd

Score

10^/10

vidar 569c252f73517f386dcc9086d37bc4ab stealer

Malware Config

Extracted

Family

vidar

Version

5.8

Botnet

569c252f73517f386dcc9086d37bc4ab

https://steamcommunity.com/profiles/76561199555780195

https://t.me/solonichat

Attributes

profile_id_v2
569c252f73517f386dcc9086d37bc4ab
user_agent
Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.0.0 Safari/537.36

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe

description	pid	process	target process
PID 2164 set thread context of 1032	2164	0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe	RegAsm.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1436 1032 WerFault.exe RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe

description pid process

Token: SeDebugPrivilege 2164 0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe

pid	pid_target	process	target process
1436	1032	WerFault.exe	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2164	0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exeRegAsm.exe

description	pid	process	target process
PID 2164 wrote to memory of 1032	2164	0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe	RegAsm.exe
PID 2164 wrote to memory of 1032	2164	0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe	RegAsm.exe
PID 2164 wrote to memory of 1032	2164	0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe	RegAsm.exe
PID 2164 wrote to memory of 1032	2164	0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe	RegAsm.exe
PID 2164 wrote to memory of 1032	2164	0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe	RegAsm.exe
PID 2164 wrote to memory of 1032	2164	0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe	RegAsm.exe
PID 2164 wrote to memory of 1032	2164	0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe	RegAsm.exe
PID 2164 wrote to memory of 1032	2164	0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe	RegAsm.exe
PID 2164 wrote to memory of 1032	2164	0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe	RegAsm.exe
PID 2164 wrote to memory of 1032	2164	0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe	RegAsm.exe
PID 2164 wrote to memory of 1032	2164	0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe	RegAsm.exe
PID 2164 wrote to memory of 1032	2164	0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe	RegAsm.exe
PID 2164 wrote to memory of 1032	2164	0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe	RegAsm.exe
PID 1032 wrote to memory of 1436	1032	RegAsm.exe	WerFault.exe
PID 1032 wrote to memory of 1436	1032	RegAsm.exe	WerFault.exe
PID 1032 wrote to memory of 1436	1032	RegAsm.exe	WerFault.exe
PID 1032 wrote to memory of 1436	1032	RegAsm.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe
"C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 256
3⤵
- Program crash
PID:1436

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-31-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1032-45-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1032-42-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1032-34-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1032-35-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1032-40-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1032-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1032-36-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1032-33-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2164-8-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

Filesize
84KB

Download
memory/2164-12-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

Filesize
84KB

Download
memory/2164-16-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

Filesize
84KB

Download
memory/2164-18-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

Filesize
84KB

Download
memory/2164-20-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

Filesize
84KB

Download
memory/2164-22-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

Filesize
84KB

Download
memory/2164-24-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

Filesize
84KB

Download
memory/2164-28-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

Filesize
84KB

Download
memory/2164-26-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

Filesize
84KB

Download
memory/2164-29-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2164-30-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download
memory/2164-14-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

Filesize
84KB

Download
memory/2164-10-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

Filesize
84KB

Download
memory/2164-0-0x0000000000ED0000-0x0000000001012000-memory.dmp

Filesize
1.3MB

Download
memory/2164-6-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

Filesize
84KB

Download
memory/2164-5-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

Filesize
84KB

Download
memory/2164-4-0x0000000000AC0000-0x0000000000ADC000-memory.dmp

Filesize
112KB

Download
memory/2164-3-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/2164-2-0x0000000004C80000-0x0000000004CC0000-memory.dmp

Filesize
256KB

Download
memory/2164-43-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2164-1-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download