Analysis

  • max time kernel
    147s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/03/2024, 11:44

General

  • Target

    2024-03-31_cfe3c5d7be1b71bc6cc4c9b944a6dc54_magniber.exe

  • Size

    27.5MB

  • MD5

    cfe3c5d7be1b71bc6cc4c9b944a6dc54

  • SHA1

    e66a13f9f1230f344968f657e53d17a91af82ec2

  • SHA256

    a9dd6c8ae44116a361b3ecbf2158d6ab92a4696858f72a3502fadccf5519b338

  • SHA512

    746f733e3f9610e3401c4e6090a6179cd07b9e98c9d0c278c6e13f2e99d226dcd21ef631dab17bafc96b5dbeb45ecfbb5a10256ccf415870df0e79ff37380f5c

  • SSDEEP

    786432:wioV8Rw7hhT9Yor0/xynXN6zBHVrh1Zs8aU6TA4bG:wioV8RkhhT9YorUydmry87yG

Score
10/10

Malware Config

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Detects executables packed with VMProtect. 2 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-31_cfe3c5d7be1b71bc6cc4c9b944a6dc54_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-31_cfe3c5d7be1b71bc6cc4c9b944a6dc54_magniber.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:4052
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 820
      2⤵
      • Program crash
      PID:2728
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4052 -ip 4052
    1⤵
      PID:1112

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4052-3-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

            Filesize

            4KB

          • memory/4052-2-0x0000000002A70000-0x0000000002A71000-memory.dmp

            Filesize

            4KB

          • memory/4052-1-0x0000000002A60000-0x0000000002A61000-memory.dmp

            Filesize

            4KB

          • memory/4052-0-0x0000000002A50000-0x0000000002A51000-memory.dmp

            Filesize

            4KB

          • memory/4052-4-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

            Filesize

            4KB

          • memory/4052-5-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

            Filesize

            4KB

          • memory/4052-8-0x00000000005D0000-0x00000000023AE000-memory.dmp

            Filesize

            29.9MB

          • memory/4052-9-0x00000000005D0000-0x00000000023AE000-memory.dmp

            Filesize

            29.9MB