vidar | c8c67f470f9d85d2e4e2ec44ed3c7bbfbdbd5b4fde5e189dede3879a984681a7

Analysis

max time kernel
26s
max time network
113s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-02-2024 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LauncherPC_S0FT/Set-up.exe
Size

596.1MB
MD5

50e223cad778bd1522afb534c1001778
SHA1

c7d7c614db48197e4474bfb496fce381ece2cb2f
SHA256

4aa7d4f2627fd363785f92635f3d3aebb2256a2366517fe50868f38c2563b1f9
SHA512

3e236b0655e45f7b1aa8a91c719a6d3c093a769971b9f3e17492b49f62eafbbc3bd0ffd3a9eceee86b262899174b2fc00df902d5a31686bb394a857c13f0004e
SSDEEP

196608:jjrU7vglcF8zp0zKmSMc8lhjjk3D1GMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGM0:jRyDSMxfoTC

Score

10^/10

vidar 97b92d10859a319d8736cd53ff3f8868 stealer

Malware Config

Extracted

Family

vidar

Version

7.8

Botnet

97b92d10859a319d8736cd53ff3f8868

http://5.252.118.12:80

https://t.me/voolkisms

https://t.me/karl3on

https://steamcommunity.com/profiles/76561199637071579

Attributes

profile_id_v2
97b92d10859a319d8736cd53ff3f8868
user_agent
Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Signatures

Detect Vidar Stealer 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2480-2-0x00000000010D0000-0x0000000001AFD000-memory.dmp	family_vidar_v7
behavioral1/memory/2480-37-0x00000000010D0000-0x0000000001AFD000-memory.dmp	family_vidar_v7
behavioral1/memory/2480-40-0x00000000010D0000-0x0000000001AFD000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

876 2480 WerFault.exe Set-up.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Set-up.exe

pid process

2480 Set-up.exe

pid	pid_target	process	target process
876	2480	WerFault.exe	Set-up.exe

pid	process
2480	Set-up.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Set-up.exe

description	pid	process	target process
PID 2480 wrote to memory of 876	2480	Set-up.exe	WerFault.exe
PID 2480 wrote to memory of 876	2480	Set-up.exe	WerFault.exe
PID 2480 wrote to memory of 876	2480	Set-up.exe	WerFault.exe
PID 2480 wrote to memory of 876	2480	Set-up.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe
"C:\Users\Admin\AppData\Local\Temp\LauncherPC_S0FT\Set-up.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 848
2⤵
- Program crash
PID:876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2480-0-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2480-2-0x00000000010D0000-0x0000000001AFD000-memory.dmp

Filesize
10.2MB

Download
memory/2480-3-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2480-5-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2480-7-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2480-6-0x0000000077000000-0x0000000077001000-memory.dmp

Filesize
4KB

Download
memory/2480-9-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2480-11-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2480-12-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2480-16-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2480-14-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2480-19-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/2480-21-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/2480-24-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/2480-26-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/2480-29-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download
memory/2480-31-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download
memory/2480-34-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2480-36-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2480-37-0x00000000010D0000-0x0000000001AFD000-memory.dmp

Filesize
10.2MB

Download
memory/2480-40-0x00000000010D0000-0x0000000001AFD000-memory.dmp

Filesize
10.2MB

Download