vidar | f22def1f82619e281fbd773bba382fd040cd017207ceb59dca7a9cdaa5662890

Analysis

max time kernel
192s
max time network
221s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 13:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 319KB
Sample240417-q34mlaad37
SHA256 f22def1f82619e281fbd773bba382fd040cd017207ceb59dca7a9cdaa5662890
MD5 d6a091caa06b3d307a706b4f5562df21
SHA1 cb98b41334e8ca963b280a70088c8b8dfa8df9ec
SHA512 d0d2708389156ad5227f6208f69c48006053644f6f40f1d5c15baafc50c0c9763d8b4c3caf0f9d72dc72b2f48326f2608b2de15d00bd933b28395e84cae75025
SSDEEP 6144:7kNn/RgaO5B70/QQB+uHg2pEqvl8z7E4xnu1asQbhKQBRp5pafzZvHbBvp3:7kNn/M70YCLgc8sQdhBvQzp5p3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar stealer

Malware Config

Extracted

Family

vidar

https://steamcommunity.com/profiles/76561199673019888
https://t.me/irfail

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Signatures

Detect Vidar Stealer 6 IoCs

stealer

resource	yara_rule
behavioral2/memory/1844-0-0x0000000000900000-0x0000000000953000-memory.dmp	family_vidar_v7
behavioral2/memory/4952-1-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/1844-2-0x0000000000900000-0x0000000000953000-memory.dmp	family_vidar_v7
behavioral2/memory/1844-3-0x0000000000900000-0x0000000000953000-memory.dmp	family_vidar_v7
behavioral2/memory/4952-5-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/4952-7-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1844 set thread context of 4952	1844	file.exe	95

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	4952	WerFault.exe	95

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 3576	1844	file.exe	93
PID 1844 wrote to memory of 3576	1844	file.exe	93
PID 1844 wrote to memory of 3576	1844	file.exe	93
PID 1844 wrote to memory of 1508	1844	file.exe	94
PID 1844 wrote to memory of 1508	1844	file.exe	94
PID 1844 wrote to memory of 1508	1844	file.exe	94
PID 1844 wrote to memory of 4952	1844	file.exe	95
PID 1844 wrote to memory of 4952	1844	file.exe	95
PID 1844 wrote to memory of 4952	1844	file.exe	95
PID 1844 wrote to memory of 4952	1844	file.exe	95
PID 1844 wrote to memory of 4952	1844	file.exe	95
PID 1844 wrote to memory of 4952	1844	file.exe	95
PID 1844 wrote to memory of 4952	1844	file.exe	95
PID 1844 wrote to memory of 4952	1844	file.exe	95
PID 1844 wrote to memory of 4952	1844	file.exe	95
PID 1844 wrote to memory of 4952	1844	file.exe	95
PID 4952 wrote to memory of 2704	4952	RegAsm.exe	103
PID 4952 wrote to memory of 2704	4952	RegAsm.exe	103
PID 4952 wrote to memory of 2704	4952	RegAsm.exe	103

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1508
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 2120
    3⤵
    - Program crash
    PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4952 -ip 4952
1⤵
PID:3428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1844-0-0x0000000000900000-0x0000000000953000-memory.dmp

Download

memory/1844-2-0x0000000000900000-0x0000000000953000-memory.dmp

Download

memory/1844-3-0x0000000000900000-0x0000000000953000-memory.dmp

Download

memory/4952-1-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/4952-5-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/4952-7-0x0000000000400000-0x0000000000648000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads