vidar | f5e03adf5f036e96aabfb0573890a026d58531d5f3fd2f0dbb313a14c9c3af72

Analysis

max time kernel
82s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
25-02-2024 21:38

Target

Set-up.exe
Size

780.4MB
MD5

828cfb01ed3c8a4fbe4960bc43bb3034
SHA1

cb44421d5eaa4930e115bc9c41803e3d04cc319c
SHA256

0f607419c8b451afe789cc226345c33ed0370fc0ec670171676d74f8ff1d44e9
SHA512

1bedd5815ad14aa2298bff7f82e33a63358e99c107cecf8f5c0c7a8fd2fcc1ea9598b3dea519e89949d815166138a984dc721df55904329fa2b76dae527f86c7
SSDEEP

196608:jjrU7vglcF8zp0zKmSMc8lhjjk3D1GMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMF:jRyDSMxfoTM6

Score

10^/10

Family

vidar

Version

7.8

Botnet

97b92d10859a319d8736cd53ff3f8868

http://5.252.118.12:80

https://t.me/voolkisms

https://t.me/karl3on

https://steamcommunity.com/profiles/76561199637071579

Attributes

profile_id_v2
97b92d10859a319d8736cd53ff3f8868
user_agent
Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Detect Vidar Stealer 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/2020-2-0x0000000000A80000-0x00000000014AD000-memory.dmp	family_vidar_v7
behavioral2/memory/2020-8-0x0000000000A80000-0x00000000014AD000-memory.dmp	family_vidar_v7
behavioral2/memory/2020-11-0x0000000000A80000-0x00000000014AD000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4932 2020 WerFault.exe Set-up.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Set-up.exe

pid process

2020 Set-up.exe
2020 Set-up.exe

pid	pid_target	process	target process
4932	2020	WerFault.exe	Set-up.exe

pid	process
2020	Set-up.exe
2020	Set-up.exe

C:\Users\Admin\AppData\Local\Temp\Set-up.exe
"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 1456
2⤵
- Program crash
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2020 -ip 2020
1⤵
PID:1604

memory/2020-0-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/2020-3-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/2020-2-0x0000000000A80000-0x00000000014AD000-memory.dmp

Filesize
10.2MB

Download
memory/2020-1-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/2020-4-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/2020-5-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/2020-6-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/2020-7-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/2020-8-0x0000000000A80000-0x00000000014AD000-memory.dmp

Filesize
10.2MB

Download
memory/2020-11-0x0000000000A80000-0x00000000014AD000-memory.dmp

Filesize
10.2MB

Download