Analysis
-
max time kernel
93s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/04/2024, 11:28
Static task
static1
Behavioral task
behavioral1
Sample
f78ea486369251e0879a5189503f607ba3168081171f6f7ee848b38009a24439.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f78ea486369251e0879a5189503f607ba3168081171f6f7ee848b38009a24439.exe
Resource
win10v2004-20240226-en
General
-
Target
f78ea486369251e0879a5189503f607ba3168081171f6f7ee848b38009a24439.exe
-
Size
279KB
-
MD5
c7e2c72570f4562314da90e3587eb63d
-
SHA1
9efe56360c46242b4aea5c13c0e918d869cc2f57
-
SHA256
f78ea486369251e0879a5189503f607ba3168081171f6f7ee848b38009a24439
-
SHA512
2525fb55e0a4c6f7c80dea0f483c0b872fef461b03a89623ce07c39acf59a4ab8bcc9cc5baa7b07554b273f4f63a26be8b6430b2a371507e5deb608646daf03b
-
SSDEEP
6144:jF7cWN69/2MFlkZ6uEkxtJDVOKk2uA59bg5FWaIe:J4WN69/NFeZXZ5ykg
Malware Config
Extracted
vidar
8.6
22d12fb91f01647fe2107fec81f0cc22
https://steamcommunity.com/profiles/76561199658817715
https://t.me/sa9ok
-
profile_id_v2
22d12fb91f01647fe2107fec81f0cc22
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Signatures
-
Detect Vidar Stealer 3 IoCs
resource yara_rule behavioral2/memory/4756-2-0x0000000000820000-0x0000000000851000-memory.dmp family_vidar_v7 behavioral2/memory/4756-3-0x0000000000400000-0x0000000000644000-memory.dmp family_vidar_v7 behavioral2/memory/4756-10-0x0000000000400000-0x0000000000644000-memory.dmp family_vidar_v7 -
Program crash 1 IoCs
pid pid_target Process procid_target 756 4756 WerFault.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\f78ea486369251e0879a5189503f607ba3168081171f6f7ee848b38009a24439.exe"C:\Users\Admin\AppData\Local\Temp\f78ea486369251e0879a5189503f607ba3168081171f6f7ee848b38009a24439.exe"1⤵PID:4756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 22642⤵
- Program crash
PID:756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4756 -ip 47561⤵PID:116