vidar | fa7f5b950d340ec4da7c437fe32031f22985034130cec41e7fd7f55c80778f38

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07-01-2024 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab292ca19cdf082ca574079c509ac729.exe
Size

750KB
MD5

ab292ca19cdf082ca574079c509ac729
SHA1

dedb710717bd0f77afb43b3e4d35c7a38d432ad0
SHA256

fa7f5b950d340ec4da7c437fe32031f22985034130cec41e7fd7f55c80778f38
SHA512

403bae833e8057a286b23ab9eaccc3be9e2d4eb295ebfd65af6d7bfbd9e8ef1d1e29015c80b13068806495e5979ef20f207fe6d76b3521bc02f7c0e80adeff89
SSDEEP

12288:tkBuS8FtXOsOr7tIShXIxy2CKrXbVExkSxOZuX86JY1oowOZ6XxAiVrjJgostV2a:trN0f7Sagy2TrXbV8kSs8XfeXv6T7YHP

Score

10^/10

vidar 921 stealer

Malware Config

Extracted

Family

vidar

Version

39.8

Botnet

921

https://xeronxikxxx.tumblr.com/

Attributes

profile_id
921

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2768-6-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

ab292ca19cdf082ca574079c509ac729.exe

description pid process target process

PID 2300 set thread context of 2768 2300 ab292ca19cdf082ca574079c509ac729.exe ab292ca19cdf082ca574079c509ac729.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ab292ca19cdf082ca574079c509ac729.exe

description pid process

Token: SeDebugPrivilege 2300 ab292ca19cdf082ca574079c509ac729.exe

description	pid	process	target process
PID 2300 set thread context of 2768	2300	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe

description	pid	process
Token: SeDebugPrivilege	2300	ab292ca19cdf082ca574079c509ac729.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ab292ca19cdf082ca574079c509ac729.exe

description	pid	process	target process
PID 2300 wrote to memory of 2768	2300	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 2300 wrote to memory of 2768	2300	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 2300 wrote to memory of 2768	2300	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 2300 wrote to memory of 2768	2300	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 2300 wrote to memory of 2768	2300	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 2300 wrote to memory of 2768	2300	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 2300 wrote to memory of 2768	2300	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 2300 wrote to memory of 2768	2300	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 2300 wrote to memory of 2768	2300	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe

C:\Users\Admin\AppData\Local\Temp\ab292ca19cdf082ca574079c509ac729.exe
"C:\Users\Admin\AppData\Local\Temp\ab292ca19cdf082ca574079c509ac729.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300

C:\Users\Admin\AppData\Local\Temp\ab292ca19cdf082ca574079c509ac729.exe
C:\Users\Admin\AppData\Local\Temp\ab292ca19cdf082ca574079c509ac729.exe
2⤵
PID:2768

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2300-0-0x0000000000380000-0x000000000043E000-memory.dmp

Filesize
760KB

Download
memory/2300-1-0x0000000074480000-0x0000000074B6E000-memory.dmp

Filesize
6.9MB

Download
memory/2300-3-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2300-2-0x00000000005F0000-0x0000000000630000-memory.dmp

Filesize
256KB

Download
memory/2300-4-0x0000000074480000-0x0000000074B6E000-memory.dmp

Filesize
6.9MB

Download
memory/2300-5-0x00000000005C0000-0x00000000005E8000-memory.dmp

Filesize
160KB

Download
memory/2300-9-0x0000000074480000-0x0000000074B6E000-memory.dmp

Filesize
6.9MB

Download
memory/2768-6-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2768-8-0x0000000000380000-0x0000000000380000-memory.dmp

Download