vidar | 81f0ea7ee9873de0118f7a630ea06da4072c8bd582ed4dc753a0124e1adb1584

Analysis

max time kernel
93s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b145481b3a46c0e94f36eb367b4fb547.exe
Size

502KB
MD5

b145481b3a46c0e94f36eb367b4fb547
SHA1

2206daf1a6e4ff8706df648888caa3bdbe5a8d6e
SHA256

81f0ea7ee9873de0118f7a630ea06da4072c8bd582ed4dc753a0124e1adb1584
SHA512

272a600c0586ef8525ad5c5c5698afbe35c65d7f9d2bb8222ba372077dc095e3159b5a973f190d67dc6e36bb56c76770f21ec36748ca18dab95c74273d0de1e3
SSDEEP

12288:YEF5nudgzNv4IG3MQLQ+RSKua8PB3JsdAZvfGA2ngUSA:YE+dgSIV0Q+vbSsdAZHOxSA

Score

10^/10

vidar 921 stealer

Malware Config

Extracted

Family

vidar

Version

39.7

Botnet

921

https://shpak125.tumblr.com/

Attributes

profile_id
921

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/1692-6-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/1692-7-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/1692-9-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/1692-11-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/1692-21-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

b145481b3a46c0e94f36eb367b4fb547.exe

description pid process target process

PID 2636 set thread context of 1692 2636 b145481b3a46c0e94f36eb367b4fb547.exe b145481b3a46c0e94f36eb367b4fb547.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3148 1692 WerFault.exe b145481b3a46c0e94f36eb367b4fb547.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b145481b3a46c0e94f36eb367b4fb547.exe

description pid process

Token: SeDebugPrivilege 2636 b145481b3a46c0e94f36eb367b4fb547.exe

description	pid	process	target process
PID 2636 set thread context of 1692	2636	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe

pid	pid_target	process	target process
3148	1692	WerFault.exe	b145481b3a46c0e94f36eb367b4fb547.exe

description	pid	process
Token: SeDebugPrivilege	2636	b145481b3a46c0e94f36eb367b4fb547.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

b145481b3a46c0e94f36eb367b4fb547.exe

description	pid	process	target process
PID 2636 wrote to memory of 2388	2636	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 2636 wrote to memory of 2388	2636	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 2636 wrote to memory of 2388	2636	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 2636 wrote to memory of 4860	2636	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 2636 wrote to memory of 4860	2636	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 2636 wrote to memory of 4860	2636	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 2636 wrote to memory of 1692	2636	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 2636 wrote to memory of 1692	2636	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 2636 wrote to memory of 1692	2636	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 2636 wrote to memory of 1692	2636	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 2636 wrote to memory of 1692	2636	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 2636 wrote to memory of 1692	2636	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 2636 wrote to memory of 1692	2636	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 2636 wrote to memory of 1692	2636	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe

C:\Users\Admin\AppData\Local\Temp\b145481b3a46c0e94f36eb367b4fb547.exe
"C:\Users\Admin\AppData\Local\Temp\b145481b3a46c0e94f36eb367b4fb547.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636

C:\Users\Admin\AppData\Local\Temp\b145481b3a46c0e94f36eb367b4fb547.exe
C:\Users\Admin\AppData\Local\Temp\b145481b3a46c0e94f36eb367b4fb547.exe
2⤵
PID:2388

C:\Users\Admin\AppData\Local\Temp\b145481b3a46c0e94f36eb367b4fb547.exe
C:\Users\Admin\AppData\Local\Temp\b145481b3a46c0e94f36eb367b4fb547.exe
2⤵
PID:4860

C:\Users\Admin\AppData\Local\Temp\b145481b3a46c0e94f36eb367b4fb547.exe
C:\Users\Admin\AppData\Local\Temp\b145481b3a46c0e94f36eb367b4fb547.exe
2⤵
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 992
3⤵
- Program crash
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1692 -ip 1692
1⤵
PID:1828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1692-6-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1692-7-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1692-9-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1692-11-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1692-21-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2636-0-0x00000000006A0000-0x0000000000720000-memory.dmp

Filesize
512KB

Download
memory/2636-1-0x0000000074B60000-0x0000000075310000-memory.dmp

Filesize
7.7MB

Download
memory/2636-2-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/2636-3-0x0000000005060000-0x0000000005074000-memory.dmp

Filesize
80KB

Download
memory/2636-4-0x0000000005130000-0x00000000051A6000-memory.dmp

Filesize
472KB

Download
memory/2636-5-0x0000000005100000-0x000000000511E000-memory.dmp

Filesize
120KB

Download
memory/2636-10-0x0000000074B60000-0x0000000075310000-memory.dmp

Filesize
7.7MB

Download