vidar | 99c80e54400e52454d0f52f294a7b05b8e05386e4a2e9007f41393fee0654cf8

Analysis

max time kernel
1798s
max time network
1819s
platform
windows7_x64
resource
win7-20240221-es
resource tags

arch:x64arch:x86image:win7-20240221-eslocale:es-esos:windows7-x64systemwindows
submitted
27-02-2024 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Set-up.exe
Size

136.2MB
MD5

df14d372ecdd495127d1c3950b4a4c9c
SHA1

384e35f8f938b27ea2f4b97afc798a25b67ae853
SHA256

99c80e54400e52454d0f52f294a7b05b8e05386e4a2e9007f41393fee0654cf8
SHA512

a7b980adfb7ad369538743c408ee5df557d50c698fd1000aaf702c29a9b16905526287d1e8f840335834945dba776247323b83a730019aa39940bac23d2d0659
SSDEEP

196608:jjrU7vglcF8zp0zKmSMc8lhjjk3D1GMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMl:jRyDSMxfoTr

Score

10^/10

vidar 97b92d10859a319d8736cd53ff3f8868 stealer

Malware Config

Extracted

Family

vidar

Version

7.8

Botnet

97b92d10859a319d8736cd53ff3f8868

http://5.252.118.12:80

https://t.me/voolkisms

https://t.me/karl3on

https://steamcommunity.com/profiles/76561199637071579

Attributes

profile_id_v2
97b92d10859a319d8736cd53ff3f8868
user_agent
Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Signatures

Detect Vidar Stealer 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1740-3-0x0000000000F70000-0x000000000199D000-memory.dmp	family_vidar_v7
behavioral1/memory/1740-37-0x0000000000F70000-0x000000000199D000-memory.dmp	family_vidar_v7
behavioral1/memory/1740-40-0x0000000000F70000-0x000000000199D000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1376 1740 WerFault.exe Set-up.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Set-up.exe

pid process

1740 Set-up.exe

pid	pid_target	process	target process
1376	1740	WerFault.exe	Set-up.exe

pid	process
1740	Set-up.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Set-up.exe

description	pid	process	target process
PID 1740 wrote to memory of 1376	1740	Set-up.exe	WerFault.exe
PID 1740 wrote to memory of 1376	1740	Set-up.exe	WerFault.exe
PID 1740 wrote to memory of 1376	1740	Set-up.exe	WerFault.exe
PID 1740 wrote to memory of 1376	1740	Set-up.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Set-up.exe
"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 840
2⤵
- Program crash
PID:1376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-0-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1740-3-0x0000000000F70000-0x000000000199D000-memory.dmp

Filesize
10.2MB

Download
memory/1740-2-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1740-6-0x00000000773B0000-0x00000000773B1000-memory.dmp

Filesize
4KB

Download
memory/1740-5-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1740-7-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1740-9-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1740-11-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1740-12-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1740-14-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1740-16-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1740-19-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1740-21-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1740-24-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/1740-26-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/1740-29-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/1740-31-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/1740-34-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/1740-36-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/1740-37-0x0000000000F70000-0x000000000199D000-memory.dmp

Filesize
10.2MB

Download
memory/1740-40-0x0000000000F70000-0x000000000199D000-memory.dmp

Filesize
10.2MB

Download