vidar | 03b38ccf2c3145839d5ea7c5ccec609de3a67a7e435e94ca05c8c080d9df4411

Analysis

max time kernel
145s
max time network
266s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2024, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
build2.exe
Size 342KB
Sample240330-nb36msdg7t
SHA256 03b38ccf2c3145839d5ea7c5ccec609de3a67a7e435e94ca05c8c080d9df4411
MD5 26544ec9adc1864de80222fb0b38e6dc
SHA1 2ca52374bb468a8e2c10d39b64d1e4e9d7d0adee
SHA512 f7eb99db8eb4df15ac252bd4523a407b32089d22c435303499bc3813ecdf1ffbc8483417bb97e901fba3e3f36c6e9e47eb30fa78b7c461d3f78f5d5899fae730
SSDEEP 3072:O+y2XhibQ/qRoIuNnxksieFNPYX+kYr/fGCqmAgma5Vn4T3+HmmcgPjxnWfH:OeaQ/q1Q+siiXX3usArNglWf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar 95002d0a9d65ffced363a8f35f42a529 stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

95002d0a9d65ffced363a8f35f42a529

https://steamcommunity.com/profiles/76561199654112719
https://t.me/r2d0s

Attributes

profile_id_v2
95002d0a9d65ffced363a8f35f42a529
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:123.0) Gecko/20100101 Firefox/123.0

Signatures

Detect Vidar Stealer 5 IoCs

stealer

resource	yara_rule
behavioral2/memory/2860-2-0x0000000004AB0000-0x0000000004AE1000-memory.dmp	family_vidar_v7
behavioral2/memory/4476-3-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral2/memory/4476-5-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral2/memory/4476-6-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral2/memory/4476-10-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2860 set thread context of 4476	2860	build2.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3464	4476	WerFault.exe	83

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 4476	2860	build2.exe	83
PID 2860 wrote to memory of 4476	2860	build2.exe	83
PID 2860 wrote to memory of 4476	2860	build2.exe	83
PID 2860 wrote to memory of 4476	2860	build2.exe	83
PID 2860 wrote to memory of 4476	2860	build2.exe	83
PID 2860 wrote to memory of 4476	2860	build2.exe	83
PID 2860 wrote to memory of 4476	2860	build2.exe	83
PID 2860 wrote to memory of 4476	2860	build2.exe	83
PID 2860 wrote to memory of 4476	2860	build2.exe	83
PID 2860 wrote to memory of 4476	2860	build2.exe	83

C:\Users\Admin\AppData\Local\Temp\build2.exe
C:\Users\Admin\AppData\Local\Temp\build2.exe cmd/c launch
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\build2.exe
  C:\Users\Admin\AppData\Local\Temp\build2.exe cmd/c launch
  2⤵
  PID:4476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 2180
    3⤵
    - Program crash
    PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4476 -ip 4476
1⤵
PID:4892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2860-1-0x0000000002F10000-0x0000000003010000-memory.dmp

Download

memory/2860-2-0x0000000004AB0000-0x0000000004AE1000-memory.dmp

Download

memory/4476-3-0x0000000000400000-0x0000000000644000-memory.dmp

Download

memory/4476-5-0x0000000000400000-0x0000000000644000-memory.dmp

Download

memory/4476-6-0x0000000000400000-0x0000000000644000-memory.dmp

Download

memory/4476-10-0x0000000000400000-0x0000000000644000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads