vidar | 1419d68eebbfbebd212e616c4210d75b1907f6e25f2bb77efb3c23cc35ef658d

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5.exe
Size

233KB
MD5

8c0a534e0e8cc04b4fd714dc4105abd7
SHA1

d31160e806095b499e7d8767b8c66d7643b90fef
SHA256

18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5
SHA512

8742f018895cbbe7120d61847b3fd8924614bb37ef9877e9d5c1300bdd845b6f6f14ab19b239f70390fb234986ad35a85c567f90f1b66c17d6d208f30c35ff55
SSDEEP

6144:6mn294xHdEFKW8huhRlfF5SC3tEhx7xwcasg1gJTUV8:1xDujlfF52hZxwXsCgg8

Score

10^/10

vidar stealer

Malware Config

Extracted

Family

vidar

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Signatures

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/3024-7-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral1/memory/3024-9-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	1688	WerFault.exe	27

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 3020	1688	18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5.exe	30
PID 1688 wrote to memory of 3020	1688	18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5.exe	30
PID 1688 wrote to memory of 3020	1688	18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5.exe	30
PID 1688 wrote to memory of 3020	1688	18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5.exe	30
PID 1688 wrote to memory of 3024	1688	18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5.exe	29
PID 1688 wrote to memory of 3024	1688	18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5.exe	29
PID 1688 wrote to memory of 3024	1688	18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5.exe	29
PID 1688 wrote to memory of 3024	1688	18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5.exe	29
PID 1688 wrote to memory of 3024	1688	18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5.exe	29
PID 1688 wrote to memory of 3024	1688	18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5.exe	29
PID 1688 wrote to memory of 3024	1688	18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5.exe	29
PID 1688 wrote to memory of 3024	1688	18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5.exe	29
PID 1688 wrote to memory of 3024	1688	18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5.exe	29
PID 1688 wrote to memory of 3024	1688	18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5.exe	29
PID 1688 wrote to memory of 3024	1688	18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5.exe	29

C:\Users\Admin\AppData\Local\Temp\18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5.exe
"C:\Users\Admin\AppData\Local\Temp\18d33f220e10209ec1b7877b42cda65ca18f6c724ee3b02cb4e5263301cb68f5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 556
  2⤵
  - Program crash
  PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-0-0x0000000000BF0000-0x0000000000C2C000-memory.dmp

Filesize
240KB

Download
memory/1688-1-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/1688-10-0x00000000021E0000-0x00000000041E0000-memory.dmp

Filesize
32.0MB

Download
memory/1688-11-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/1688-12-0x00000000021E0000-0x00000000041E0000-memory.dmp

Filesize
32.0MB

Download
memory/3024-4-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/3024-5-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/3024-6-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/3024-7-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/3024-9-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download