Analysis
-
max time kernel
92s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 07:01
Static task
static1
Behavioral task
behavioral1
Sample
8dae8b6a6be6e3527183594d1c26a2d3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8dae8b6a6be6e3527183594d1c26a2d3.exe
Resource
win10v2004-20240226-en
General
-
Target
8dae8b6a6be6e3527183594d1c26a2d3.exe
-
Size
277KB
-
MD5
8dae8b6a6be6e3527183594d1c26a2d3
-
SHA1
b87e40cee60869a36e79c88c8a3a34baf0bc4889
-
SHA256
afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5
-
SHA512
0bf065700db647efba39a13a58242a595907e6c11885575cf0bdad9e23ab40583c8a6535464e46d75d075e20d88b7a6305a761df9da787fdc8728483dd48f96e
-
SSDEEP
6144:GtcSsUDC2OZuhYRQqPY3x/OKV/LYZsTZgzENh+a1:TSsUO2cuhY1m/VYZsI
Malware Config
Extracted
vidar
8.6
5739ef2bbcd39fcd59c5746bfe4238c5
https://steamcommunity.com/profiles/76561199658817715
https://t.me/sa9ok
-
profile_id_v2
5739ef2bbcd39fcd59c5746bfe4238c5
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Signatures
-
Detect Vidar Stealer 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2248-3-0x00000000022B0000-0x00000000022E1000-memory.dmp family_vidar_v7 behavioral2/memory/3452-2-0x0000000000400000-0x0000000000644000-memory.dmp family_vidar_v7 behavioral2/memory/3452-5-0x0000000000400000-0x0000000000644000-memory.dmp family_vidar_v7 behavioral2/memory/3452-6-0x0000000000400000-0x0000000000644000-memory.dmp family_vidar_v7 behavioral2/memory/3452-10-0x0000000000400000-0x0000000000644000-memory.dmp family_vidar_v7 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8dae8b6a6be6e3527183594d1c26a2d3.exedescription pid process target process PID 2248 set thread context of 3452 2248 8dae8b6a6be6e3527183594d1c26a2d3.exe 8dae8b6a6be6e3527183594d1c26a2d3.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1608 3452 WerFault.exe 8dae8b6a6be6e3527183594d1c26a2d3.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
8dae8b6a6be6e3527183594d1c26a2d3.exedescription pid process target process PID 2248 wrote to memory of 3452 2248 8dae8b6a6be6e3527183594d1c26a2d3.exe 8dae8b6a6be6e3527183594d1c26a2d3.exe PID 2248 wrote to memory of 3452 2248 8dae8b6a6be6e3527183594d1c26a2d3.exe 8dae8b6a6be6e3527183594d1c26a2d3.exe PID 2248 wrote to memory of 3452 2248 8dae8b6a6be6e3527183594d1c26a2d3.exe 8dae8b6a6be6e3527183594d1c26a2d3.exe PID 2248 wrote to memory of 3452 2248 8dae8b6a6be6e3527183594d1c26a2d3.exe 8dae8b6a6be6e3527183594d1c26a2d3.exe PID 2248 wrote to memory of 3452 2248 8dae8b6a6be6e3527183594d1c26a2d3.exe 8dae8b6a6be6e3527183594d1c26a2d3.exe PID 2248 wrote to memory of 3452 2248 8dae8b6a6be6e3527183594d1c26a2d3.exe 8dae8b6a6be6e3527183594d1c26a2d3.exe PID 2248 wrote to memory of 3452 2248 8dae8b6a6be6e3527183594d1c26a2d3.exe 8dae8b6a6be6e3527183594d1c26a2d3.exe PID 2248 wrote to memory of 3452 2248 8dae8b6a6be6e3527183594d1c26a2d3.exe 8dae8b6a6be6e3527183594d1c26a2d3.exe PID 2248 wrote to memory of 3452 2248 8dae8b6a6be6e3527183594d1c26a2d3.exe 8dae8b6a6be6e3527183594d1c26a2d3.exe PID 2248 wrote to memory of 3452 2248 8dae8b6a6be6e3527183594d1c26a2d3.exe 8dae8b6a6be6e3527183594d1c26a2d3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dae8b6a6be6e3527183594d1c26a2d3.exe"C:\Users\Admin\AppData\Local\Temp\8dae8b6a6be6e3527183594d1c26a2d3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8dae8b6a6be6e3527183594d1c26a2d3.exe"C:\Users\Admin\AppData\Local\Temp\8dae8b6a6be6e3527183594d1c26a2d3.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 22283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3452 -ip 34521⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2248-3-0x00000000022B0000-0x00000000022E1000-memory.dmpFilesize
196KB
-
memory/2248-1-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/3452-2-0x0000000000400000-0x0000000000644000-memory.dmpFilesize
2.3MB
-
memory/3452-5-0x0000000000400000-0x0000000000644000-memory.dmpFilesize
2.3MB
-
memory/3452-6-0x0000000000400000-0x0000000000644000-memory.dmpFilesize
2.3MB
-
memory/3452-10-0x0000000000400000-0x0000000000644000-memory.dmpFilesize
2.3MB