Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-03-2024 10:48

General

  • Target

    d89c941f24184dae521e0c528d54b0fb.exe

  • Size

    539KB

  • MD5

    d89c941f24184dae521e0c528d54b0fb

  • SHA1

    389e916b7e91f95ee5bf2a02372897c9626c4a67

  • SHA256

    a2c32c272c564873a80bdfe148ba4a23ca64b821546556e4076923a0db1c931f

  • SHA512

    b2188e04e0aedf7362008bbf20b4e10162c9c932e0f88f0d5109b8f07bad96bbd35b57e118e677213fdccde0a6bacba4c8d27791126b9d8919e3c28aa505bba4

  • SSDEEP

    12288:0YFBtBFov+xOZuX86JY1oowOZ6XxAiVrjJgostVH8V:0PGs8XfeXv6T7YHH8V

Score
10/10

Malware Config

Extracted

Family

vidar

Version

39.8

Botnet

921

C2

https://xeronxikxxx.tumblr.com/

Attributes
  • profile_id

    921

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d89c941f24184dae521e0c528d54b0fb.exe
    "C:\Users\Admin\AppData\Local\Temp\d89c941f24184dae521e0c528d54b0fb.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Users\Admin\AppData\Local\Temp\d89c941f24184dae521e0c528d54b0fb.exe
      C:\Users\Admin\AppData\Local\Temp\d89c941f24184dae521e0c528d54b0fb.exe
      2⤵
        PID:1460
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 996
          3⤵
          • Program crash
          PID:3036
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1460 -ip 1460
      1⤵
        PID:1268

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1460-6-0x0000000000400000-0x00000000004A1000-memory.dmp
        Filesize

        644KB

      • memory/1460-8-0x0000000000400000-0x00000000004A1000-memory.dmp
        Filesize

        644KB

      • memory/1460-10-0x0000000000400000-0x00000000004A1000-memory.dmp
        Filesize

        644KB

      • memory/1460-11-0x0000000000400000-0x00000000004A1000-memory.dmp
        Filesize

        644KB

      • memory/1460-21-0x0000000000400000-0x00000000004A1000-memory.dmp
        Filesize

        644KB

      • memory/1648-0-0x00000000009E0000-0x0000000000A6A000-memory.dmp
        Filesize

        552KB

      • memory/1648-1-0x0000000074EE0000-0x0000000075690000-memory.dmp
        Filesize

        7.7MB

      • memory/1648-2-0x0000000005510000-0x0000000005520000-memory.dmp
        Filesize

        64KB

      • memory/1648-3-0x00000000053E0000-0x0000000005456000-memory.dmp
        Filesize

        472KB

      • memory/1648-4-0x0000000005460000-0x000000000547E000-memory.dmp
        Filesize

        120KB

      • memory/1648-5-0x0000000005500000-0x0000000005514000-memory.dmp
        Filesize

        80KB

      • memory/1648-9-0x0000000074EE0000-0x0000000075690000-memory.dmp
        Filesize

        7.7MB