vidar | f5e03adf5f036e96aabfb0573890a026d58531d5f3fd2f0dbb313a14c9c3af72

Analysis

max time kernel
109s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 21:38

Target

Set-up.exe
Size

780.4MB
MD5

828cfb01ed3c8a4fbe4960bc43bb3034
SHA1

cb44421d5eaa4930e115bc9c41803e3d04cc319c
SHA256

0f607419c8b451afe789cc226345c33ed0370fc0ec670171676d74f8ff1d44e9
SHA512

1bedd5815ad14aa2298bff7f82e33a63358e99c107cecf8f5c0c7a8fd2fcc1ea9598b3dea519e89949d815166138a984dc721df55904329fa2b76dae527f86c7
SSDEEP

196608:jjrU7vglcF8zp0zKmSMc8lhjjk3D1GMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMF:jRyDSMxfoTM6

Score

10^/10

Family

vidar

Version

7.8

Botnet

97b92d10859a319d8736cd53ff3f8868

http://5.252.118.12:80

https://t.me/voolkisms

https://t.me/karl3on

https://steamcommunity.com/profiles/76561199637071579

Attributes

profile_id_v2
97b92d10859a319d8736cd53ff3f8868
user_agent
Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Detect Vidar Stealer 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1120-1-0x0000000000CD0000-0x00000000016FD000-memory.dmp	family_vidar_v7
behavioral1/memory/1120-8-0x0000000000CD0000-0x00000000016FD000-memory.dmp	family_vidar_v7
behavioral1/memory/1120-11-0x0000000000CD0000-0x00000000016FD000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

556 1120 WerFault.exe Set-up.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Set-up.exe

pid process

1120 Set-up.exe
1120 Set-up.exe

pid	pid_target	process	target process
556	1120	WerFault.exe	Set-up.exe

pid	process
1120	Set-up.exe
1120	Set-up.exe

C:\Users\Admin\AppData\Local\Temp\Set-up.exe
"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 1380
2⤵
- Program crash
PID:556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1120 -ip 1120
1⤵
PID:4636

memory/1120-1-0x0000000000CD0000-0x00000000016FD000-memory.dmp

Filesize
10.2MB

Download
memory/1120-0-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/1120-2-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/1120-5-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/1120-4-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/1120-3-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/1120-6-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/1120-7-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/1120-8-0x0000000000CD0000-0x00000000016FD000-memory.dmp

Filesize
10.2MB

Download
memory/1120-11-0x0000000000CD0000-0x00000000016FD000-memory.dmp

Filesize
10.2MB

Download