vidar | ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2024, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 224KB
Sample240320-t9ylpsdb37
SHA256 ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2
MD5 64e47700b815961651caebc56291cc9e
SHA1 f017eddecb5403271ea526a1a8f45ddfe55fa33e
SHA512 7a6fd8eaebf6f6b0ba171639a1801110ad4057ba01d0a93e1584d77c8978a3845ab4a7f9b1cd67a086d3b987a167b624454e07c64ddbab29b21caed807a4c69f
SSDEEP 6144:80LCsH7jz9XE4mmAFkTwUX9EW36RuOpJaUoNjFCa:+sH7jzpbmDFjckRuO3Qj8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar 4cf8d799a3641f9821e54be56c960e28 stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

4cf8d799a3641f9821e54be56c960e28

https://steamcommunity.com/profiles/76561199654112719
https://t.me/r2d0s

Attributes

profile_id_v2
4cf8d799a3641f9821e54be56c960e28
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:123.0) Gecko/20100101 Firefox/123.0

Signatures

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/memory/956-4-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral2/memory/956-7-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral2/memory/956-12-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 408 set thread context of 956	408	file.exe	89

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4696	956	WerFault.exe	89

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 956	408	file.exe	89
PID 408 wrote to memory of 956	408	file.exe	89
PID 408 wrote to memory of 956	408	file.exe	89
PID 408 wrote to memory of 956	408	file.exe	89
PID 408 wrote to memory of 956	408	file.exe	89
PID 408 wrote to memory of 956	408	file.exe	89
PID 408 wrote to memory of 956	408	file.exe	89
PID 408 wrote to memory of 956	408	file.exe	89
PID 408 wrote to memory of 956	408	file.exe	89
PID 408 wrote to memory of 956	408	file.exe	89

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 2216
    3⤵
    - Program crash
    PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 956 -ip 956
1⤵
PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/408-0-0x0000000000E80000-0x0000000000EBE000-memory.dmp

Download

memory/408-1-0x0000000074680000-0x0000000074E30000-memory.dmp

Download

memory/408-11-0x0000000074680000-0x0000000074E30000-memory.dmp

Download

memory/408-10-0x00000000031E0000-0x00000000051E0000-memory.dmp

Download

memory/956-4-0x0000000000400000-0x0000000000644000-memory.dmp

Download

memory/956-7-0x0000000000400000-0x0000000000644000-memory.dmp

Download

memory/956-12-0x0000000000400000-0x0000000000644000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads