vidar | dbd591557d6127cd2c160f4ef72684442ee38c44266ada6b4f3b73f0e37cfbc9

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ba3ef1c28b50c99c26ba79db0cf12aef.exe
Size 543KB
Sample240308-ch9q8ace27
SHA256 dbd591557d6127cd2c160f4ef72684442ee38c44266ada6b4f3b73f0e37cfbc9
MD5 ba3ef1c28b50c99c26ba79db0cf12aef
SHA1 acc0e1208a0ab621e764dba0831c50f6d4ab09da
SHA512 5fa4384ae225a0a23b63e36abfec8c32bfaf5a25d457079a7c56b5bc1d042ecd7356f0b16f22571faaa60e03486d250ce12be80021c6c5e6f4550a9c403ecfdc
SSDEEP 12288:R6sHjPXHj+gsevLu788RNggZIIgOl06i:FDPT+v4Lu7b/ZIYi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar 706 stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

https://lenak513.tumblr.com/

Attributes

profile_id
706

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral2/memory/2688-2-0x0000000004910000-0x00000000049AD000-memory.dmp	family_vidar
behavioral2/memory/2688-3-0x0000000000400000-0x0000000002D16000-memory.dmp	family_vidar
behavioral2/memory/2688-13-0x0000000000400000-0x0000000002D16000-memory.dmp	family_vidar
behavioral2/memory/2688-14-0x0000000004910000-0x00000000049AD000-memory.dmp	family_vidar

Program crash 17 IoCs

pid	pid_target	Process	procid_target
5092	2688	WerFault.exe	88
4456	2688	WerFault.exe	88
1256	2688	WerFault.exe	88
536	2688	WerFault.exe	88
4236	2688	WerFault.exe	88
4408	2688	WerFault.exe	88
2524	2688	WerFault.exe	88
3204	2688	WerFault.exe	88
4052	2688	WerFault.exe	88
436	2688	WerFault.exe	88
388	2688	WerFault.exe	88
1736	2688	WerFault.exe	88
3852	2688	WerFault.exe	88
1268	2688	WerFault.exe	88
1464	2688	WerFault.exe	88
1028	2688	WerFault.exe	88
4624	2688	WerFault.exe	88

C:\Users\Admin\AppData\Local\Temp\ba3ef1c28b50c99c26ba79db0cf12aef.exe
"C:\Users\Admin\AppData\Local\Temp\ba3ef1c28b50c99c26ba79db0cf12aef.exe"
1⤵
PID:2688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 824
  2⤵
  - Program crash
  PID:5092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 860
  2⤵
  - Program crash
  PID:4456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 880
  2⤵
  - Program crash
  PID:1256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 908
  2⤵
  - Program crash
  PID:536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 984
  2⤵
  - Program crash
  PID:4236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 1068
  2⤵
  - Program crash
  PID:4408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 1132
  2⤵
  - Program crash
  PID:2524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 1492
  2⤵
  - Program crash
  PID:3204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 1560
  2⤵
  - Program crash
  PID:4052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 1504
  2⤵
  - Program crash
  PID:436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 1744
  2⤵
  - Program crash
  PID:388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 1556
  2⤵
  - Program crash
  PID:1736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 1744
  2⤵
  - Program crash
  PID:3852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 1620
  2⤵
  - Program crash
  PID:1268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 1556
  2⤵
  - Program crash
  PID:1464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 1620
  2⤵
  - Program crash
  PID:1028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 1040
  2⤵
  - Program crash
  PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2688 -ip 2688
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2688 -ip 2688
1⤵
PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2688 -ip 2688
1⤵
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2688 -ip 2688
1⤵
PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2688 -ip 2688
1⤵
PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2688 -ip 2688
1⤵
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2688 -ip 2688
1⤵
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2688 -ip 2688
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2688 -ip 2688
1⤵
PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2688 -ip 2688
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2688 -ip 2688
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2688 -ip 2688
1⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2688 -ip 2688
1⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2688 -ip 2688
1⤵
PID:3568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2688 -ip 2688
1⤵
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2688 -ip 2688
1⤵
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2688 -ip 2688
1⤵
PID:2256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2688-1-0x0000000002E50000-0x0000000002F50000-memory.dmp

Download

memory/2688-2-0x0000000004910000-0x00000000049AD000-memory.dmp

Download

memory/2688-3-0x0000000000400000-0x0000000002D16000-memory.dmp

Download

memory/2688-13-0x0000000000400000-0x0000000002D16000-memory.dmp

Download

memory/2688-14-0x0000000004910000-0x00000000049AD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads