vidar | f5e03adf5f036e96aabfb0573890a026d58531d5f3fd2f0dbb313a14c9c3af72

Analysis

max time kernel
119s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-02-2024 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Set-up.exe
Size

780.4MB
MD5

828cfb01ed3c8a4fbe4960bc43bb3034
SHA1

cb44421d5eaa4930e115bc9c41803e3d04cc319c
SHA256

0f607419c8b451afe789cc226345c33ed0370fc0ec670171676d74f8ff1d44e9
SHA512

1bedd5815ad14aa2298bff7f82e33a63358e99c107cecf8f5c0c7a8fd2fcc1ea9598b3dea519e89949d815166138a984dc721df55904329fa2b76dae527f86c7
SSDEEP

196608:jjrU7vglcF8zp0zKmSMc8lhjjk3D1GMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMF:jRyDSMxfoTM6

Score

10^/10

vidar 97b92d10859a319d8736cd53ff3f8868 stealer

Malware Config

Extracted

Family

vidar

Version

7.8

Botnet

97b92d10859a319d8736cd53ff3f8868

http://5.252.118.12:80

https://t.me/voolkisms

https://t.me/karl3on

https://steamcommunity.com/profiles/76561199637071579

Attributes

profile_id_v2
97b92d10859a319d8736cd53ff3f8868
user_agent
Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Signatures

Detect Vidar Stealer 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2332-3-0x0000000000F50000-0x000000000197D000-memory.dmp	family_vidar_v7
behavioral1/memory/2332-37-0x0000000000F50000-0x000000000197D000-memory.dmp	family_vidar_v7
behavioral1/memory/2332-40-0x0000000000F50000-0x000000000197D000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

928 2332 WerFault.exe Set-up.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Set-up.exe

pid process

2332 Set-up.exe

pid	pid_target	process	target process
928	2332	WerFault.exe	Set-up.exe

pid	process
2332	Set-up.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Set-up.exe

description	pid	process	target process
PID 2332 wrote to memory of 928	2332	Set-up.exe	WerFault.exe
PID 2332 wrote to memory of 928	2332	Set-up.exe	WerFault.exe
PID 2332 wrote to memory of 928	2332	Set-up.exe	WerFault.exe
PID 2332 wrote to memory of 928	2332	Set-up.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Set-up.exe
"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 872
2⤵
- Program crash
PID:928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-0-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2332-2-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2332-3-0x0000000000F50000-0x000000000197D000-memory.dmp

Filesize
10.2MB

Download
memory/2332-6-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2332-5-0x0000000077DB0000-0x0000000077DB1000-memory.dmp

Filesize
4KB

Download
memory/2332-7-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2332-9-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2332-11-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2332-12-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2332-16-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2332-14-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2332-19-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/2332-21-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/2332-24-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2332-26-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2332-29-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2332-31-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2332-36-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2332-34-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2332-37-0x0000000000F50000-0x000000000197D000-memory.dmp

Filesize
10.2MB

Download
memory/2332-40-0x0000000000F50000-0x000000000197D000-memory.dmp

Filesize
10.2MB

Download
memory/2332-41-0x0000000077DB0000-0x0000000077DB1000-memory.dmp

Filesize
4KB

Download