vidar | f3d744b6b3c378518e95dc021ee00151b2d380e7360e3b4521e5b52e55757740

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe
Size

224KB
MD5

78f23006210bda6b5e26b8cbefa9758a
SHA1

b1a191597f5a2ecdd3b9185b89072cfae06ae5cd
SHA256

631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907
SHA512

cf073cd4df9b13a9c79d9908952b88e9aef7c57c208031a6a758b2e3176841dfaa90206228af0c6a08c3b266b06fcd46d00ebde9c98906408affec9fbd9d0cc2
SSDEEP

6144:No9+UOY1p3TTTFt/rIQuwkpAoVBIiNeXtd5yE:NEOAZtXtueXtdR

Score

10^/10

vidar debff3f4f38e9beeaf8e215a762c8549 stealer

Malware Config

Extracted

Family

vidar

Version

8.6

Botnet

debff3f4f38e9beeaf8e215a762c8549

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok

Attributes

profile_id_v2
debff3f4f38e9beeaf8e215a762c8549
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Signatures

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral1/memory/1744-8-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral1/memory/1744-9-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral1/memory/1744-11-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2176	2084	WerFault.exe	27

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1744	2084	631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe	29
PID 2084 wrote to memory of 1744	2084	631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe	29
PID 2084 wrote to memory of 1744	2084	631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe	29
PID 2084 wrote to memory of 1744	2084	631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe	29
PID 2084 wrote to memory of 1744	2084	631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe	29
PID 2084 wrote to memory of 1744	2084	631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe	29
PID 2084 wrote to memory of 1744	2084	631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe	29
PID 2084 wrote to memory of 1744	2084	631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe	29
PID 2084 wrote to memory of 1744	2084	631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe	29
PID 2084 wrote to memory of 1744	2084	631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe	29
PID 2084 wrote to memory of 1744	2084	631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe	29
PID 2084 wrote to memory of 2176	2084	631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe	30
PID 2084 wrote to memory of 2176	2084	631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe	30
PID 2084 wrote to memory of 2176	2084	631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe	30
PID 2084 wrote to memory of 2176	2084	631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe	30
PID 2084 wrote to memory of 1744	2084	631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe	29
PID 2084 wrote to memory of 1744	2084	631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe	29

C:\Users\Admin\AppData\Local\Temp\631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe
"C:\Users\Admin\AppData\Local\Temp\631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 556
  2⤵
  - Program crash
  PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-4-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/1744-7-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/1744-8-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/1744-6-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/1744-9-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/1744-11-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/1744-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2084-0-0x0000000000D70000-0x0000000000DAA000-memory.dmp

Filesize
232KB

Download
memory/2084-1-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2084-5-0x00000000023E0000-0x00000000043E0000-memory.dmp

Filesize
32.0MB

Download
memory/2084-14-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2084-15-0x00000000023E0000-0x00000000043E0000-memory.dmp

Filesize
32.0MB

Download