vidar | 58c48e2b1d3d26ac96cebf8c114750582d4cdeef46a05bbf706c4b4630c541ff

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
31/03/2024, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 234KB
Sample240331-m3dvdsae4s
SHA256 58c48e2b1d3d26ac96cebf8c114750582d4cdeef46a05bbf706c4b4630c541ff
MD5 d0492d61a010c75b69a21b31761ac655
SHA1 0168759aebd253fed1dd89a44d260f6eadc94a2d
SHA512 e4552a5bcf7f6b7911a87873d6d168d44f4ab0f351c822b5ec3b14b5db359ce0fadecac7bc032111197243b79047cbe1203e4fa9afc558c9f9e2a0ecb28eb52d
SSDEEP 6144:AhAZ0mc86LHVUCAlfzHORKOrfIrIEgcNxHookuvxNimwE5R:ImcJLHVpAl7o3rfwrYt+7/r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar stealer

Malware Config

Extracted

Family

vidar

https://steamcommunity.com/profiles/76561199658817715
https://t.me/sa9ok

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Signatures

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral1/memory/2904-8-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral1/memory/2904-9-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral1/memory/2904-10-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	2884	WerFault.exe	27

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2904	2884	file.exe	29
PID 2884 wrote to memory of 2904	2884	file.exe	29
PID 2884 wrote to memory of 2904	2884	file.exe	29
PID 2884 wrote to memory of 2904	2884	file.exe	29
PID 2884 wrote to memory of 2904	2884	file.exe	29
PID 2884 wrote to memory of 2904	2884	file.exe	29
PID 2884 wrote to memory of 2904	2884	file.exe	29
PID 2884 wrote to memory of 2904	2884	file.exe	29
PID 2884 wrote to memory of 2904	2884	file.exe	29
PID 2884 wrote to memory of 2904	2884	file.exe	29
PID 2884 wrote to memory of 2988	2884	file.exe	30
PID 2884 wrote to memory of 2988	2884	file.exe	30
PID 2884 wrote to memory of 2988	2884	file.exe	30
PID 2884 wrote to memory of 2988	2884	file.exe	30
PID 2884 wrote to memory of 2904	2884	file.exe	29
PID 2884 wrote to memory of 2904	2884	file.exe	29
PID 2884 wrote to memory of 2904	2884	file.exe	29

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 516
  2⤵
  - Program crash
  PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2884-0-0x0000000000990000-0x00000000009CC000-memory.dmp

Download

memory/2884-1-0x0000000074AE0000-0x00000000751CE000-memory.dmp

Download

memory/2884-4-0x00000000020F0000-0x00000000040F0000-memory.dmp

Download

memory/2884-13-0x0000000074AE0000-0x00000000751CE000-memory.dmp

Download

memory/2884-14-0x00000000020F0000-0x00000000040F0000-memory.dmp

Download

memory/2904-5-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2904-6-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2904-7-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2904-8-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2904-9-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2904-10-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2904-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads