vidar | 0f607419c8b451afe789cc226345c33ed0370fc0ec670171676d74f8ff1d44e9

Analysis

max time kernel
121s
max time network
161s
platform
windows7_x64
resource
win7-20231129-es
resource tags

arch:x64arch:x86image:win7-20231129-eslocale:es-esos:windows7-x64systemwindows
submitted
01-04-2024 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Set-up.exe
Size

780.4MB
MD5

828cfb01ed3c8a4fbe4960bc43bb3034
SHA1

cb44421d5eaa4930e115bc9c41803e3d04cc319c
SHA256

0f607419c8b451afe789cc226345c33ed0370fc0ec670171676d74f8ff1d44e9
SHA512

1bedd5815ad14aa2298bff7f82e33a63358e99c107cecf8f5c0c7a8fd2fcc1ea9598b3dea519e89949d815166138a984dc721df55904329fa2b76dae527f86c7
SSDEEP

196608:jjrU7vglcF8zp0zKmSMc8lhjjk3D1GMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMGMF:jRyDSMxfoTM6

Score

10^/10

vidar 97b92d10859a319d8736cd53ff3f8868 stealer

Malware Config

Extracted

Family

vidar

Version

7.8

Botnet

97b92d10859a319d8736cd53ff3f8868

http://5.252.118.12:80

https://t.me/voolkisms

https://t.me/karl3on

https://steamcommunity.com/profiles/76561199637071579

Attributes

profile_id_v2
97b92d10859a319d8736cd53ff3f8868
user_agent
Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Signatures

Detect Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2164-2-0x0000000001360000-0x0000000001D8D000-memory.dmp	family_vidar_v7
behavioral1/memory/2164-40-0x0000000001360000-0x0000000001D8D000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2648 2164 WerFault.exe Set-up.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Set-up.exe

pid process

2164 Set-up.exe

pid	pid_target	process	target process
2648	2164	WerFault.exe	Set-up.exe

pid	process
2164	Set-up.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Set-up.exe

description	pid	process	target process
PID 2164 wrote to memory of 2648	2164	Set-up.exe	WerFault.exe
PID 2164 wrote to memory of 2648	2164	Set-up.exe	WerFault.exe
PID 2164 wrote to memory of 2648	2164	Set-up.exe	WerFault.exe
PID 2164 wrote to memory of 2648	2164	Set-up.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Set-up.exe
"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 852
2⤵
- Program crash
PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2164-0-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2164-2-0x0000000001360000-0x0000000001D8D000-memory.dmp

Filesize
10.2MB

Download
memory/2164-3-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2164-5-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2164-6-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2164-8-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2164-10-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2164-12-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2164-11-0x00000000778F0000-0x00000000778F1000-memory.dmp

Filesize
4KB

Download
memory/2164-16-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2164-14-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2164-31-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2164-36-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2164-34-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2164-29-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2164-26-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2164-24-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2164-21-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2164-19-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2164-40-0x0000000001360000-0x0000000001D8D000-memory.dmp

Filesize
10.2MB

Download