Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/04/2024, 13:05
Static task
static1
Behavioral task
behavioral1
Sample
132b4fe0337a790a4f0e00cd6cc02bd865b02519c76054b58a448e72f1afc8de.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
132b4fe0337a790a4f0e00cd6cc02bd865b02519c76054b58a448e72f1afc8de.exe
Resource
win10v2004-20240226-en
General
-
Target
132b4fe0337a790a4f0e00cd6cc02bd865b02519c76054b58a448e72f1afc8de.exe
-
Size
254KB
-
MD5
0dd9c75127249bef183e9c7829a753b2
-
SHA1
a676ecef0e553b5291f22fa3b0e5432d9261ee56
-
SHA256
132b4fe0337a790a4f0e00cd6cc02bd865b02519c76054b58a448e72f1afc8de
-
SHA512
da0defdff346c0ee846beeb6ca8d597a7329f88b6ae51aa7cdd66e81ea387fd57e092d8b74f3d8e789d16a840f5956151ae7a1287bca11cbbc721c4cd9fc14c0
-
SSDEEP
3072:JSdGd+nuuUlooMbGH03xPJHcL3QqAfnZLr9ODJpMsEZv4xOvI:Adpuh+oMtxHcDQ5OV+id
Malware Config
Extracted
vidar
6.4
181eb512368c942704e3ada53738a1d7
https://t.me/secgoxrp
https://steamcommunity.com/profiles/76561199568528949
-
profile_id_v2
181eb512368c942704e3ada53738a1d7
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:110.0) Gecko/20100101 Firefox/121.0
Signatures
-
Detect Vidar Stealer 4 IoCs
resource yara_rule behavioral2/memory/4952-2-0x0000000002530000-0x0000000002556000-memory.dmp family_vidar_v7 behavioral2/memory/4952-3-0x0000000000400000-0x00000000007C8000-memory.dmp family_vidar_v7 behavioral2/memory/4952-17-0x0000000000400000-0x00000000007C8000-memory.dmp family_vidar_v7 behavioral2/memory/4952-18-0x0000000002530000-0x0000000002556000-memory.dmp family_vidar_v7 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 376 4952 WerFault.exe 84 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 132b4fe0337a790a4f0e00cd6cc02bd865b02519c76054b58a448e72f1afc8de.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 132b4fe0337a790a4f0e00cd6cc02bd865b02519c76054b58a448e72f1afc8de.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4952 132b4fe0337a790a4f0e00cd6cc02bd865b02519c76054b58a448e72f1afc8de.exe 4952 132b4fe0337a790a4f0e00cd6cc02bd865b02519c76054b58a448e72f1afc8de.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\132b4fe0337a790a4f0e00cd6cc02bd865b02519c76054b58a448e72f1afc8de.exe"C:\Users\Admin\AppData\Local\Temp\132b4fe0337a790a4f0e00cd6cc02bd865b02519c76054b58a448e72f1afc8de.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 16042⤵
- Program crash
PID:376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4952 -ip 49521⤵PID:4936