Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
31/03/2024, 01:18
General
- Target 495cc873782d89bbda1d58b8146643d2_JaffaCakes118.exe
- Size 770KB
- Sample240331-bn5h1sbf86
- SHA256 a8a0a1685c2b9f3127ca5f689b0a548ded32e5e88bb554ab86fcad9cee843d6f
Score
10/10
Malware Config
Extracted
Family
-
vidar
Version
-
41.2
Botnet
-
1008
C2
-
https://mas.to/@serg4325
Attributes
-
profile_id
1008
Signatures
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar Stealer 4 IoCs
- Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\495cc873782d89bbda1d58b8146643d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\495cc873782d89bbda1d58b8146643d2_JaffaCakes118.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 10082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3096 -ip 30961⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3096-1-0x0000000001860000-0x0000000001960000-memory.dmp
memory/3096-2-0x0000000003330000-0x0000000003406000-memory.dmp
memory/3096-3-0x0000000000400000-0x0000000001734000-memory.dmp
memory/3096-10-0x0000000000400000-0x0000000001734000-memory.dmp
memory/3096-11-0x0000000003330000-0x0000000003406000-memory.dmp