vidar | f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 238KB
Sample240329-m7zbwsfd6s
SHA256 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697
MD5 0ce3dc374e49433d7e15d02c015e0ee3
SHA1 71882bb02d1fa7b4a0f824afdcc1cd53bdb85ba1
SHA512 a68b25bd8170205d491f3409393757eda6ec4c2b7f31e985b57a8d5fe9e876264167d2228087c6645ebd6dee6522386f9e39e631e6a7f06783f401432df730fa
SSDEEP 6144:hABBPmUqO791Ou5dscGTGnbpZfcATrKTJJzM5E:hABBOa90uzVWGlRmTJX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar stealer

Malware Config

Extracted

Family

vidar

https://steamcommunity.com/profiles/76561199658817715
https://t.me/sa9ok

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Signatures

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/memory/4320-4-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/4320-7-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/4320-9-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1184 set thread context of 4320	1184	file.exe	87

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4420	1184	WerFault.exe	83
3292	4320	WerFault.exe	87

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 4320	1184	file.exe	87
PID 1184 wrote to memory of 4320	1184	file.exe	87
PID 1184 wrote to memory of 4320	1184	file.exe	87
PID 1184 wrote to memory of 4320	1184	file.exe	87
PID 1184 wrote to memory of 4320	1184	file.exe	87
PID 1184 wrote to memory of 4320	1184	file.exe	87
PID 1184 wrote to memory of 4320	1184	file.exe	87
PID 1184 wrote to memory of 4320	1184	file.exe	87
PID 1184 wrote to memory of 4320	1184	file.exe	87
PID 1184 wrote to memory of 4320	1184	file.exe	87

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 2256
    3⤵
    - Program crash
    PID:3292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 868
  2⤵
  - Program crash
  PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1184 -ip 1184
1⤵
PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4320 -ip 4320
1⤵
PID:4888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-0-0x0000000000520000-0x000000000055E000-memory.dmp

Download

memory/1184-1-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Download

memory/1184-10-0x00000000029C0000-0x00000000049C0000-memory.dmp

Download

memory/1184-14-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Download

memory/4320-4-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/4320-7-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/4320-9-0x0000000000400000-0x0000000000648000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads