vidar | a183934f8e5161ab94c2bd78598b6138b3990a3a2c55b82fa5a7137be3cf6f72

Analysis

max time kernel
141s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 09:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcaddb2c0a5dc68823c6515cb8d6626a.exe
Size

292KB
MD5

dcaddb2c0a5dc68823c6515cb8d6626a
SHA1

f1eeb346b025a4f7baa4891874fb90131010e46b
SHA256

a183934f8e5161ab94c2bd78598b6138b3990a3a2c55b82fa5a7137be3cf6f72
SHA512

9f787eb8e42e71f7703c235b02b2ae805b11d69a7338ee1f04ccf96465a0e762bbff98db7404480d4864db547f5e4cc041e5a45d28c84cd5f5cd51c6cf666aee
SSDEEP

6144:l6WOR0LVpyLjfb4PQF/9H3c9H36O/NTg7t:4WYQVozUYlHs9Kc

Score

10^/10

vidar b8a5ebfe4a0abceff8d2cd1a6c6c4024 stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

b8a5ebfe4a0abceff8d2cd1a6c6c4024

https://steamcommunity.com/profiles/76561199644883218

https://t.me/neoschats

Attributes

profile_id_v2
b8a5ebfe4a0abceff8d2cd1a6c6c4024
user_agent
Mozilla/5.0 (Linux; Android 11; M2102J20SG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Mobile Safari/537.36 EdgA/97.0.1072.78

Signatures

Detect Vidar Stealer 7 IoCs

stealer

resource	yara_rule
behavioral2/memory/4636-2-0x0000000001BF0000-0x0000000001C26000-memory.dmp	family_vidar_v7
behavioral2/memory/4636-3-0x0000000000400000-0x0000000001A35000-memory.dmp	family_vidar_v7
behavioral2/memory/4636-4-0x0000000000400000-0x0000000001A35000-memory.dmp	family_vidar_v7
behavioral2/memory/4636-5-0x0000000000400000-0x0000000001A35000-memory.dmp	family_vidar_v7
behavioral2/memory/4636-7-0x0000000001BF0000-0x0000000001C26000-memory.dmp	family_vidar_v7
behavioral2/memory/4636-10-0x0000000000400000-0x0000000001A35000-memory.dmp	family_vidar_v7
behavioral2/memory/4636-12-0x0000000000400000-0x0000000001A35000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1200	4636	WerFault.exe	72

C:\Users\Admin\AppData\Local\Temp\dcaddb2c0a5dc68823c6515cb8d6626a.exe
"C:\Users\Admin\AppData\Local\Temp\dcaddb2c0a5dc68823c6515cb8d6626a.exe"
1⤵
PID:4636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 2076
  2⤵
  - Program crash
  PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4636 -ip 4636
1⤵
PID:552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4636-1-0x0000000001C70000-0x0000000001D70000-memory.dmp

Filesize
1024KB

Download
memory/4636-2-0x0000000001BF0000-0x0000000001C26000-memory.dmp

Filesize
216KB

Download
memory/4636-3-0x0000000000400000-0x0000000001A35000-memory.dmp

Filesize
22.2MB

Download
memory/4636-4-0x0000000000400000-0x0000000001A35000-memory.dmp

Filesize
22.2MB

Download
memory/4636-5-0x0000000000400000-0x0000000001A35000-memory.dmp

Filesize
22.2MB

Download
memory/4636-7-0x0000000001BF0000-0x0000000001C26000-memory.dmp

Filesize
216KB

Download
memory/4636-9-0x0000000001C70000-0x0000000001D70000-memory.dmp

Filesize
1024KB

Download
memory/4636-10-0x0000000000400000-0x0000000001A35000-memory.dmp

Filesize
22.2MB

Download
memory/4636-12-0x0000000000400000-0x0000000001A35000-memory.dmp

Filesize
22.2MB

Download