Analysis
-
max time kernel
144s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
31/03/2024, 01:01
Static task
static1
Behavioral task
behavioral1
Sample
f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe
Resource
win7-20240221-en
General
-
Target
f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe
-
Size
238KB
-
MD5
0ce3dc374e49433d7e15d02c015e0ee3
-
SHA1
71882bb02d1fa7b4a0f824afdcc1cd53bdb85ba1
-
SHA256
f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697
-
SHA512
a68b25bd8170205d491f3409393757eda6ec4c2b7f31e985b57a8d5fe9e876264167d2228087c6645ebd6dee6522386f9e39e631e6a7f06783f401432df730fa
-
SSDEEP
6144:hABBPmUqO791Ou5dscGTGnbpZfcATrKTJJzM5E:hABBOa90uzVWGlRmTJX
Malware Config
Extracted
vidar
https://steamcommunity.com/profiles/76561199658817715
https://t.me/sa9ok
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Signatures
-
Detect Vidar Stealer 3 IoCs
resource yara_rule behavioral2/memory/2388-4-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/2388-7-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/2388-9-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1844 set thread context of 2388 1844 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 91 -
Program crash 2 IoCs
pid pid_target Process procid_target 3536 1844 WerFault.exe 84 3076 2388 WerFault.exe 91 -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1844 wrote to memory of 2504 1844 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 90 PID 1844 wrote to memory of 2504 1844 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 90 PID 1844 wrote to memory of 2504 1844 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 90 PID 1844 wrote to memory of 2388 1844 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 91 PID 1844 wrote to memory of 2388 1844 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 91 PID 1844 wrote to memory of 2388 1844 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 91 PID 1844 wrote to memory of 2388 1844 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 91 PID 1844 wrote to memory of 2388 1844 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 91 PID 1844 wrote to memory of 2388 1844 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 91 PID 1844 wrote to memory of 2388 1844 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 91 PID 1844 wrote to memory of 2388 1844 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 91 PID 1844 wrote to memory of 2388 1844 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 91 PID 1844 wrote to memory of 2388 1844 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe"C:\Users\Admin\AppData\Local\Temp\f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2504
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 22483⤵
- Program crash
PID:3076
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 8842⤵
- Program crash
PID:3536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1844 -ip 18441⤵PID:2692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2388 -ip 23881⤵PID:3104