vidar | 81558a3c9cbe55a8651ac888d1666d08863b4a074ff168db618d56d88ea3f570

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81558a3c9cbe55a8651ac888d1666d08863b4a074ff168db618d56d88ea3f570.exe
Size

422KB
MD5

b0d93933d118e0736edd9c77579599a2
SHA1

18f00d3d16eb674abb13ac425b50721512834473
SHA256

81558a3c9cbe55a8651ac888d1666d08863b4a074ff168db618d56d88ea3f570
SHA512

2ef16c3c70ca09829c779d5d1e9b2370e6ed043f1109c807deed2dc119fb7411c9d505328f6cf719809c36e3fce0fbd9962eff55ec12ad84a8e04e32a62e9c47
SSDEEP

6144:3ImWfejL3SWY9KMq/60bp1JOPaWeu6N1UPi93Bst0Kk2m8Riqnwu:3xY9KV/60bIPaDN14iOS8Riowu

Score

10^/10

vidar stealer

Malware Config

Extracted

Family

vidar

https://steamcommunity.com/profiles/76561199662282318

https://t.me/t8jmhl

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 OPR/108.0.0.0

Signatures

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/4120-1-0x0000000001310000-0x0000000001558000-memory.dmp	family_vidar_v7
behavioral2/memory/4120-10-0x0000000001310000-0x0000000001558000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/memory/4120-10-0x0000000001310000-0x0000000001558000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/memory/4120-10-0x0000000001310000-0x0000000001558000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral2/memory/4120-1-0x0000000001310000-0x0000000001558000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4120-10-0x0000000001310000-0x0000000001558000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
behavioral2/memory/4120-10-0x0000000001310000-0x0000000001558000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral2/memory/4120-1-0x0000000001310000-0x0000000001558000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/4120-10-0x0000000001310000-0x0000000001558000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1808	4120	WerFault.exe	84
2040	4120	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\81558a3c9cbe55a8651ac888d1666d08863b4a074ff168db618d56d88ea3f570.exe
"C:\Users\Admin\AppData\Local\Temp\81558a3c9cbe55a8651ac888d1666d08863b4a074ff168db618d56d88ea3f570.exe"
1⤵
PID:4120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 2240
  2⤵
  - Program crash
  PID:1808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 2244
  2⤵
  - Program crash
  PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4120 -ip 4120
1⤵
PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4120 -ip 4120
1⤵
PID:4292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4120-0-0x0000000077861000-0x0000000077981000-memory.dmp

Filesize
1.1MB

Download
memory/4120-1-0x0000000001310000-0x0000000001558000-memory.dmp

Filesize
2.3MB

Download
memory/4120-10-0x0000000001310000-0x0000000001558000-memory.dmp

Filesize
2.3MB

Download