vidar | b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd

Analysis

max time kernel
93s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe
Size

278KB
MD5

b6bbb03b84e589433f139d88ca24c62d
SHA1

2eeeed07176de200eaf5bc207852781ddc5da2b5
SHA256

b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd
SHA512

09075709691b8fba668184b2469c5bdc7174bcb3e16de2d046bf7abff6257f941e36d2a28db2e42b88807e1ba3c15165875fb82485c621d60f9001bed62ee4de
SSDEEP

6144:5ok6GPg9b2t0eQnQqRRtf3G82ed6JcVsk:5D6GPg9b2t5+jRtfJdJB

Score

10^/10

vidar debff3f4f38e9beeaf8e215a762c8549 stealer

Malware Config

Extracted

Family

vidar

Version

8.6

Botnet

debff3f4f38e9beeaf8e215a762c8549

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok

Attributes

profile_id_v2
debff3f4f38e9beeaf8e215a762c8549
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Signatures

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/memory/3128-6-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral2/memory/3128-9-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral2/memory/3128-12-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Windows executables referencing non-Windows User-Agents 3 IoCs

resource	yara_rule
behavioral2/memory/3128-6-0x0000000000400000-0x0000000000644000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3128-9-0x0000000000400000-0x0000000000644000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3128-12-0x0000000000400000-0x0000000000644000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 3 IoCs

resource	yara_rule
behavioral2/memory/3128-6-0x0000000000400000-0x0000000000644000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/3128-9-0x0000000000400000-0x0000000000644000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/3128-12-0x0000000000400000-0x0000000000644000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1540 set thread context of 3128	1540	b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe	88

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4276	1540	WerFault.exe	84
2632	3128	WerFault.exe	88

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 3128	1540	b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe	88
PID 1540 wrote to memory of 3128	1540	b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe	88
PID 1540 wrote to memory of 3128	1540	b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe	88
PID 1540 wrote to memory of 3128	1540	b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe	88
PID 1540 wrote to memory of 3128	1540	b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe	88
PID 1540 wrote to memory of 3128	1540	b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe	88
PID 1540 wrote to memory of 3128	1540	b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe	88
PID 1540 wrote to memory of 3128	1540	b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe	88
PID 1540 wrote to memory of 3128	1540	b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe	88
PID 1540 wrote to memory of 3128	1540	b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe	88

C:\Users\Admin\AppData\Local\Temp\b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe
"C:\Users\Admin\AppData\Local\Temp\b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 2196
    3⤵
    - Program crash
    PID:2632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 836
  2⤵
  - Program crash
  PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1540 -ip 1540
1⤵
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3128 -ip 3128
1⤵
PID:4968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1540-0-0x00000000001F0000-0x0000000000238000-memory.dmp

Filesize
288KB

Download
memory/1540-1-0x0000000074FA0000-0x0000000075750000-memory.dmp

Filesize
7.7MB

Download
memory/1540-2-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/1540-3-0x00000000027E0000-0x00000000027E1000-memory.dmp

Filesize
4KB

Download
memory/1540-11-0x0000000002810000-0x0000000004810000-memory.dmp

Filesize
32.0MB

Download
memory/1540-19-0x0000000074FA0000-0x0000000075750000-memory.dmp

Filesize
7.7MB

Download
memory/3128-6-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/3128-9-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/3128-12-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download