vidar | 776cb16fa265a9974e9cdfa28c1985961e19cf559c8b21ea5830c5b56e0f19d4

Analysis

max time kernel
142s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2ca26b93e327619505af1547737e619_JaffaCakes118.exe
Size

743KB
MD5

f2ca26b93e327619505af1547737e619
SHA1

14a4345ade54359da4a76a66632633642fe0cbd5
SHA256

776cb16fa265a9974e9cdfa28c1985961e19cf559c8b21ea5830c5b56e0f19d4
SHA512

9399675c4d84166f9084676aed7765d9d9782aa01e378d78bfb504158aaa6f2bca32b2e61c56055acfecb45daa9115c804b097e3c9a87450ac4c7d4cc58a24db
SSDEEP

12288:Qhxn8Gw/gyz9nPqnrCQxFHIEnzaHmL1vHLNKY8cFzP8Uv+fqraWkzPAiZ:Q381/gyxPNQxFoEnzaHmL1rNOOzrTbk0

Score

10^/10

vidar 903 stealer

Malware Config

Extracted

Family

vidar

Version

41.3

Botnet

903

https://mas.to/@oleg98

Attributes

profile_id
903

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral1/memory/2756-2-0x0000000002FF0000-0x00000000030C6000-memory.dmp	family_vidar
behavioral1/memory/2756-3-0x0000000000400000-0x000000000172D000-memory.dmp	family_vidar
behavioral1/memory/2756-19-0x0000000000400000-0x000000000172D000-memory.dmp	family_vidar
behavioral1/memory/2756-22-0x0000000002FF0000-0x00000000030C6000-memory.dmp	family_vidar

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	2756	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2668	2756	f2ca26b93e327619505af1547737e619_JaffaCakes118.exe	28
PID 2756 wrote to memory of 2668	2756	f2ca26b93e327619505af1547737e619_JaffaCakes118.exe	28
PID 2756 wrote to memory of 2668	2756	f2ca26b93e327619505af1547737e619_JaffaCakes118.exe	28
PID 2756 wrote to memory of 2668	2756	f2ca26b93e327619505af1547737e619_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f2ca26b93e327619505af1547737e619_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f2ca26b93e327619505af1547737e619_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 872
  2⤵
  - Program crash
  PID:2668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2756-1-0x00000000017D0000-0x00000000018D0000-memory.dmp

Filesize
1024KB

Download
memory/2756-2-0x0000000002FF0000-0x00000000030C6000-memory.dmp

Filesize
856KB

Download
memory/2756-3-0x0000000000400000-0x000000000172D000-memory.dmp

Filesize
19.2MB

Download
memory/2756-19-0x0000000000400000-0x000000000172D000-memory.dmp

Filesize
19.2MB

Download
memory/2756-20-0x00000000017D0000-0x00000000018D0000-memory.dmp

Filesize
1024KB

Download
memory/2756-22-0x0000000002FF0000-0x00000000030C6000-memory.dmp

Filesize
856KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads