Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/04/2024, 11:28
Static task
static1
Behavioral task
behavioral1
Sample
b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe
Resource
win10v2004-20240226-en
General
-
Target
b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe
-
Size
278KB
-
MD5
b6bbb03b84e589433f139d88ca24c62d
-
SHA1
2eeeed07176de200eaf5bc207852781ddc5da2b5
-
SHA256
b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd
-
SHA512
09075709691b8fba668184b2469c5bdc7174bcb3e16de2d046bf7abff6257f941e36d2a28db2e42b88807e1ba3c15165875fb82485c621d60f9001bed62ee4de
-
SSDEEP
6144:5ok6GPg9b2t0eQnQqRRtf3G82ed6JcVsk:5D6GPg9b2t5+jRtfJdJB
Malware Config
Extracted
vidar
8.6
debff3f4f38e9beeaf8e215a762c8549
https://steamcommunity.com/profiles/76561199658817715
https://t.me/sa9ok
-
profile_id_v2
debff3f4f38e9beeaf8e215a762c8549
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Signatures
-
Detect Vidar Stealer 3 IoCs
resource yara_rule behavioral1/memory/2520-11-0x0000000000400000-0x0000000000644000-memory.dmp family_vidar_v7 behavioral1/memory/2520-10-0x0000000000400000-0x0000000000644000-memory.dmp family_vidar_v7 behavioral1/memory/2520-9-0x0000000000400000-0x0000000000644000-memory.dmp family_vidar_v7 -
Program crash 1 IoCs
pid pid_target Process procid_target 3040 2236 WerFault.exe 27 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2236 b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2236 wrote to memory of 3040 2236 b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe 30 PID 2236 wrote to memory of 3040 2236 b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe 30 PID 2236 wrote to memory of 3040 2236 b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe 30 PID 2236 wrote to memory of 3040 2236 b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe 30 PID 2236 wrote to memory of 2520 2236 b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe 29 PID 2236 wrote to memory of 2520 2236 b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe 29 PID 2236 wrote to memory of 2520 2236 b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe 29 PID 2236 wrote to memory of 2520 2236 b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe 29 PID 2236 wrote to memory of 2520 2236 b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe 29 PID 2236 wrote to memory of 2520 2236 b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe 29 PID 2236 wrote to memory of 2520 2236 b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe 29 PID 2236 wrote to memory of 2520 2236 b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe 29 PID 2236 wrote to memory of 2520 2236 b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe 29 PID 2236 wrote to memory of 2520 2236 b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe 29 PID 2236 wrote to memory of 2520 2236 b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe 29 PID 2236 wrote to memory of 2520 2236 b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe 29 PID 2236 wrote to memory of 2520 2236 b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe"C:\Users\Admin\AppData\Local\Temp\b9220e18f15660f7649d01f17b9b787982442067449c0f27fce621f365b91edd.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2520
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 5682⤵
- Program crash
PID:3040
-