vidar | cd76a354a02015517a2b50d75aa3b68dd0e3164adbb040f6317251016bc62b21

Resubmissions

20-03-2024 23:00

240320-2y4btadd85 10

15-03-2024 20:34

240315-zcmqtscf84 10

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe
Size

455KB
MD5

ca4016d215c65d3c44fffa0c5ff31cbc
SHA1

38df050b14a8566e4a57706e91884fa7826779e7
SHA256

02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b
SHA512

cf16707bc4f35f1ebe33691c20f116181f4714ed6417ead9b88f656e4fa1e848dc042e02a6b4a5c280b8bba516b3253a5cfd4a557c62ab14ec5d47b107f1ad52
SSDEEP

12288:/GUT7l7g57eLmTgcH0GIsbU7i9f/jyarsT:/GUT7l7wamQGk7i9f/3rw

Score

10^/10

vidar 408 stealer

Malware Config

Extracted

Family

vidar

Version

2.5

Botnet

408

https://t.me/noktasina

https://steamcommunity.com/profiles/76561199478503353

http://95.217.152.87:80

Attributes

profile_id
408
user_agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.0.0 Safari/537.36

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1048 set thread context of 1628	1048	02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe	29

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1628	1048	02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe	29
PID 1048 wrote to memory of 1628	1048	02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe	29
PID 1048 wrote to memory of 1628	1048	02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe	29
PID 1048 wrote to memory of 1628	1048	02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe	29
PID 1048 wrote to memory of 1628	1048	02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe	29
PID 1048 wrote to memory of 1628	1048	02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe	29
PID 1048 wrote to memory of 1628	1048	02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe	29
PID 1048 wrote to memory of 1628	1048	02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe	29
PID 1048 wrote to memory of 1628	1048	02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe	29

C:\Users\Admin\AppData\Local\Temp\02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe
"C:\Users\Admin\AppData\Local\Temp\02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabFDB2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2715.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/1048-1-0x0000000000090000-0x0000000000190000-memory.dmp

Filesize
1024KB

Download
memory/1628-2-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1628-4-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1628-9-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1628-11-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1628-12-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download