vidar | b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1.exe
Size

354KB
MD5

960eb4d74f0f0c05c4c43ce1e98bf571
SHA1

9739d9e27dbc19091eeadc3c6d18d3f3d351bff1
SHA256

b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1
SHA512

514ba4019ea244b62c4f31b4199869c9bdf1c172bc890e5467ce2afb16cfd7bbda7b8049b9149b1d1db8e6cd86cc98ae6cf89a0daefcc395c222dbbf7c979cc6
SSDEEP

6144:43kc+V5W0MPeogbh0HWE0J98gBzl6e/u:u4MG+eSgBzlZ

Score

10^/10

vidar zgrat aa2e2e94c456b90a61eb47ba9d0c2074 rat stealer

Malware Config

Extracted

Family

vidar

Version

8.4

Botnet

aa2e2e94c456b90a61eb47ba9d0c2074

https://steamcommunity.com/profiles/76561199654112719

https://t.me/r2d0s

Attributes

profile_id_v2
aa2e2e94c456b90a61eb47ba9d0c2074
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:123.0) Gecko/20100101 Firefox/123.0

Signatures

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral1/memory/3356-5-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral1/memory/3356-11-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral1/memory/3356-13-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/3756-1-0x0000000000090000-0x00000000000EE000-memory.dmp	family_zgrat_v1

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3756 set thread context of 3356	3756	b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1.exe	103

Program crash 1 IoCs

pid	pid_target	Process	procid_target
968	3356	WerFault.exe	103

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 640	3756	b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1.exe	102
PID 3756 wrote to memory of 640	3756	b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1.exe	102
PID 3756 wrote to memory of 640	3756	b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1.exe	102
PID 3756 wrote to memory of 3356	3756	b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1.exe	103
PID 3756 wrote to memory of 3356	3756	b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1.exe	103
PID 3756 wrote to memory of 3356	3756	b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1.exe	103
PID 3756 wrote to memory of 3356	3756	b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1.exe	103
PID 3756 wrote to memory of 3356	3756	b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1.exe	103
PID 3756 wrote to memory of 3356	3756	b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1.exe	103
PID 3756 wrote to memory of 3356	3756	b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1.exe	103
PID 3756 wrote to memory of 3356	3756	b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1.exe	103
PID 3756 wrote to memory of 3356	3756	b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1.exe	103
PID 3756 wrote to memory of 3356	3756	b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1.exe	103

C:\Users\Admin\AppData\Local\Temp\b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1.exe
"C:\Users\Admin\AppData\Local\Temp\b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 2248
    3⤵
    - Program crash
    PID:968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3356 -ip 3356
1⤵
PID:2216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:2416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3356-5-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/3356-11-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/3356-13-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/3756-0-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/3756-1-0x0000000000090000-0x00000000000EE000-memory.dmp

Filesize
376KB

Download
memory/3756-2-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/3756-7-0x0000000002520000-0x0000000004520000-memory.dmp

Filesize
32.0MB

Download
memory/3756-9-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download