vidar | 0bf2d7d979b705f2d965e1e4f119281568c0d713b3e3e6897b770c61b7dc186d

Analysis

max time kernel
195s
max time network
162s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-02-2024 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Set-up.exe
Size

549.8MB
MD5

5fd86873179802d4ae53b9942f762113
SHA1

6d2a112c3a74967fca99c339cd458a2965085416
SHA256

0bf2d7d979b705f2d965e1e4f119281568c0d713b3e3e6897b770c61b7dc186d
SHA512

7281b0c8175dc4fbebb019d8fd661f24a069507a04c05edb682ad9059efffad2e57d4914424a6fb28781c6dc75f37dd46d1053147a094917903c2e992a258b70
SSDEEP

196608:jjrU7vglcF8zp0zKmSMc8lhjjk3D1GMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMV:jRyDSMxfoT7

Score

10^/10

vidar 97b92d10859a319d8736cd53ff3f8868 stealer

Malware Config

Extracted

Family

vidar

Version

7.8

Botnet

97b92d10859a319d8736cd53ff3f8868

http://5.252.118.12:80

https://t.me/voolkisms

https://t.me/karl3on

https://steamcommunity.com/profiles/76561199637071579

Attributes

profile_id_v2
97b92d10859a319d8736cd53ff3f8868
user_agent
Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Signatures

Detect Vidar Stealer 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2628-3-0x0000000000370000-0x0000000000D9D000-memory.dmp	family_vidar_v7
behavioral1/memory/2628-37-0x0000000000370000-0x0000000000D9D000-memory.dmp	family_vidar_v7
behavioral1/memory/2628-40-0x0000000000370000-0x0000000000D9D000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

576 2628 WerFault.exe Set-up.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Set-up.exe

pid process

2628 Set-up.exe

pid	pid_target	process	target process
576	2628	WerFault.exe	Set-up.exe

pid	process
2628	Set-up.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	2920	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2920	AUDIODG.EXE
Token: 33	2920	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2920	AUDIODG.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Set-up.exe

description	pid	process	target process
PID 2628 wrote to memory of 576	2628	Set-up.exe	WerFault.exe
PID 2628 wrote to memory of 576	2628	Set-up.exe	WerFault.exe
PID 2628 wrote to memory of 576	2628	Set-up.exe	WerFault.exe
PID 2628 wrote to memory of 576	2628	Set-up.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Set-up.exe
"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 872
2⤵
- Program crash
PID:576

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1476

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x148
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2628-0-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2628-3-0x0000000000370000-0x0000000000D9D000-memory.dmp

Filesize
10.2MB

Download
memory/2628-2-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2628-6-0x0000000077C00000-0x0000000077C01000-memory.dmp

Filesize
4KB

Download
memory/2628-5-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2628-7-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2628-9-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2628-11-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2628-12-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2628-16-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2628-14-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2628-19-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2628-21-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2628-24-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2628-26-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2628-29-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2628-31-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2628-34-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2628-36-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2628-37-0x0000000000370000-0x0000000000D9D000-memory.dmp

Filesize
10.2MB

Download
memory/2628-40-0x0000000000370000-0x0000000000D9D000-memory.dmp

Filesize
10.2MB

Download