vidar | 704c2f0e203223810c05462aa15a9bbe501202ce851f79164b80cbca733ca39e

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup-Full_Free.exe
Size 202KB
Sample240402-mevg8sfc57
SHA256 c26db97858c427d92e393396f7cb7f9e7ed8f9ce616adcc123d0ec6b055b99c9
MD5 64179e64675e822559cac6652298bdfc
SHA1 cceed3b2441146762512918af7bf7f89fb055583
SHA512 ef740b35ea5190f8ee47776af1f15ebdd54d39c84da5665e64f67ae6dd0f4b181e955e9a35319a5d0bd764972562e8f2bc44dbdf83c3bedf05674eae902e7280
SSDEEP 3072:EMtKztOp6KfOQqoY3ltdNjlcwsSdplkrxf+Uyecgw:ELKfOQLY3l9jlcwnlUf+z7gw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar 528b8c7c892572a5fcf7ec6c40735c90 stealer

Malware Config

Extracted

Family

vidar

Botnet

528b8c7c892572a5fcf7ec6c40735c90

https://78.47.78.87
https://steamcommunity.com/profiles/76561199651834633
https://t.me/raf6ik

Attributes

profile_id_v2
528b8c7c892572a5fcf7ec6c40735c90
user_agent
Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Signatures

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/memory/1120-26-0x0000000000700000-0x0000000000E48000-memory.dmp	family_vidar_v7
behavioral2/memory/1120-28-0x0000000000700000-0x0000000000E48000-memory.dmp	family_vidar_v7
behavioral2/memory/1120-42-0x0000000000700000-0x0000000000E48000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3172 set thread context of 2032	3172	Setup-Full_Free.exe	88

Loads dropped DLL 1 IoCs

pid	Process
1120	GraphicsFillRect.au3

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2764	1120	WerFault.exe	97

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3172	Setup-Full_Free.exe
3172	Setup-Full_Free.exe
2032	more.com
2032	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3172	Setup-Full_Free.exe
2032	more.com

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 2032	3172	Setup-Full_Free.exe	88
PID 3172 wrote to memory of 2032	3172	Setup-Full_Free.exe	88
PID 3172 wrote to memory of 2032	3172	Setup-Full_Free.exe	88
PID 3172 wrote to memory of 2032	3172	Setup-Full_Free.exe	88
PID 2032 wrote to memory of 1120	2032	more.com	97
PID 2032 wrote to memory of 1120	2032	more.com	97
PID 2032 wrote to memory of 1120	2032	more.com	97
PID 2032 wrote to memory of 1120	2032	more.com	97
PID 2032 wrote to memory of 1120	2032	more.com	97
PID 2032 wrote to memory of 1120	2032	more.com	97

C:\Users\Admin\AppData\Local\Temp\Setup-Full_Free.exe
"C:\Users\Admin\AppData\Local\Temp\Setup-Full_Free.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Users\Admin\AppData\Local\Temp\GraphicsFillRect.au3
    C:\Users\Admin\AppData\Local\Temp\GraphicsFillRect.au3
    3⤵
    - Loads dropped DLL
    PID:1120
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 1532
      4⤵
      Program crash
      PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1120 -ip 1120
1⤵
PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

8f6ec5e6

Path C:\Users\Admin\AppData\Local\Temp\8f6ec5e6
Size 6.8MB
SHA256 e6a1eabd3914c41d2e50bcc4105f51e5270ee7036b32b7f3527cc49e3d874719
MD5 bc8054e50e90b4eb6d553c6b87cb2289
SHA1 3697880c730cf441a2fdd91ff78421dd00ad207f
SHA512 6424df97e9f3aaf1e9ed4e3fc8c6713debc6ef64a46a1065d32a1cb65457d4ea43f9b8219768387988b8c179f0f01d3af013ba05b39cde9688c6fe09d4dc13df
SSDEEP 98304:1F60X+VHJAdc+x5Ahhi49wjq2JtqgNXqKRNXo1lw7Rr4IkKz0lHb2cV:1YTH6dxbAhhWqsltm67p4mA5x
MD5 SHA1 SHA512 SSDEEP

Submit Download

GraphicsFillRect.au3

Path C:\Users\Admin\AppData\Local\Temp\GraphicsFillRect.au3
Size 925KB
SHA256 15600ccdef5a64b40d206d89234a51be1e11bd878dcefc5986590bcf40d9d571
MD5 0162a97ed477353bc35776a7addffd5c
SHA1 10db8fe20bbce0f10517c510ec73532cf6feb227
SHA512 9638cab1aabe78c22a3d3528a391544f697d792640d831516b63fa52c393ee96bb588223e70163d059208cc5a14481c5ff7ef6ba9ac572322798a823d67f01f5
SSDEEP 24576:7yL1NdEcgjRnuWbIv216yoEGGPve5KIHbaCB+m:7mBrQRFbIcaGPml7aCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1120-42-0x0000000000700000-0x0000000000E48000-memory.dmp

Download

memory/1120-28-0x0000000000700000-0x0000000000E48000-memory.dmp

Download

memory/1120-26-0x0000000000700000-0x0000000000E48000-memory.dmp

Download

memory/1120-25-0x00007FFC8D5B0000-0x00007FFC8D7A5000-memory.dmp

Download

memory/2032-23-0x00000000758D0000-0x0000000075A4B000-memory.dmp

Download

memory/2032-17-0x00000000758D0000-0x0000000075A4B000-memory.dmp

Download

memory/2032-18-0x00000000758D0000-0x0000000075A4B000-memory.dmp

Download

memory/2032-15-0x00007FFC8D5B0000-0x00007FFC8D7A5000-memory.dmp

Download

memory/2032-13-0x00000000758D0000-0x0000000075A4B000-memory.dmp

Download

memory/3172-0-0x00000000758D0000-0x0000000075A4B000-memory.dmp

Download

memory/3172-11-0x00000000758D0000-0x0000000075A4B000-memory.dmp

Download

memory/3172-10-0x00000000758D0000-0x0000000075A4B000-memory.dmp

Download

memory/3172-1-0x00007FFC8D5B0000-0x00007FFC8D7A5000-memory.dmp

Download