Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system -
submitted
27-03-2024 16:31
Static task
static1
Behavioral task
behavioral1
Sample
afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe
Resource
win11-20240214-en
General
-
Target
afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe
-
Size
277KB
-
MD5
8dae8b6a6be6e3527183594d1c26a2d3
-
SHA1
b87e40cee60869a36e79c88c8a3a34baf0bc4889
-
SHA256
afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5
-
SHA512
0bf065700db647efba39a13a58242a595907e6c11885575cf0bdad9e23ab40583c8a6535464e46d75d075e20d88b7a6305a761df9da787fdc8728483dd48f96e
-
SSDEEP
6144:GtcSsUDC2OZuhYRQqPY3x/OKV/LYZsTZgzENh+a1:TSsUO2cuhY1m/VYZsI
Malware Config
Extracted
vidar
8.6
5739ef2bbcd39fcd59c5746bfe4238c5
https://steamcommunity.com/profiles/76561199658817715
https://t.me/sa9ok
-
profile_id_v2
5739ef2bbcd39fcd59c5746bfe4238c5
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Signatures
-
Detect Vidar Stealer 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3548-1-0x0000000000400000-0x0000000000644000-memory.dmp family_vidar_v7 behavioral2/memory/4976-3-0x00000000023F0000-0x0000000002421000-memory.dmp family_vidar_v7 behavioral2/memory/3548-5-0x0000000000400000-0x0000000000644000-memory.dmp family_vidar_v7 behavioral2/memory/3548-6-0x0000000000400000-0x0000000000644000-memory.dmp family_vidar_v7 behavioral2/memory/3548-15-0x0000000000400000-0x0000000000644000-memory.dmp family_vidar_v7 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exedescription pid process target process PID 4976 set thread context of 3548 4976 afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2200 3548 WerFault.exe afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exedescription pid process target process PID 4976 wrote to memory of 3548 4976 afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe PID 4976 wrote to memory of 3548 4976 afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe PID 4976 wrote to memory of 3548 4976 afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe PID 4976 wrote to memory of 3548 4976 afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe PID 4976 wrote to memory of 3548 4976 afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe PID 4976 wrote to memory of 3548 4976 afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe PID 4976 wrote to memory of 3548 4976 afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe PID 4976 wrote to memory of 3548 4976 afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe PID 4976 wrote to memory of 3548 4976 afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe PID 4976 wrote to memory of 3548 4976 afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe"C:\Users\Admin\AppData\Local\Temp\afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe"C:\Users\Admin\AppData\Local\Temp\afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 10683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 3548 -ip 35481⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3548-1-0x0000000000400000-0x0000000000644000-memory.dmpFilesize
2.3MB
-
memory/3548-5-0x0000000000400000-0x0000000000644000-memory.dmpFilesize
2.3MB
-
memory/3548-6-0x0000000000400000-0x0000000000644000-memory.dmpFilesize
2.3MB
-
memory/3548-15-0x0000000000400000-0x0000000000644000-memory.dmpFilesize
2.3MB
-
memory/4976-3-0x00000000023F0000-0x0000000002421000-memory.dmpFilesize
196KB
-
memory/4976-2-0x00000000007D0000-0x00000000008D0000-memory.dmpFilesize
1024KB