vidar | 35c92bbeaf69c27f5a4fed4f9b52af72de47ccc66cb1494ff12d716a23da9969

Analysis

max time kernel
139s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97a504256f3e7627c02025fe05e4330d9d8fdf222db845371238da6dc75ddca1.exe
Size

268KB
MD5

9cded6231bc11b77032dbf321a65a16b
SHA1

a91fd07758ac2189920f62e3e6245ba2b91f091b
SHA256

97a504256f3e7627c02025fe05e4330d9d8fdf222db845371238da6dc75ddca1
SHA512

7ed2e6913c7c823971bcffe3275e7c436ede119320bdd4465a10ff5b15f81138feadb0cab9a64d743fd08ddf5441f78750d65a4c4a3d55cd576f1e5e82138116
SSDEEP

3072:TTqs+j7RsNC8jHj4izDObQoZZKTcouI2g/6XzzzMXaWjFeIy9Oyx:Xaj7RQ1Hj//ObQoucou4/6XzrWFexM

Score

10^/10

vidar f3872ed7b089c1810bdd0f3418ae791c discovery stealer

Malware Config

Extracted

Family

vidar

Version

6.4

Botnet

f3872ed7b089c1810bdd0f3418ae791c

https://t.me/secgoxrp

https://steamcommunity.com/profiles/76561199568528949

Attributes

profile_id_v2
f3872ed7b089c1810bdd0f3418ae791c
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:110.0) Gecko/20100101 Firefox/121.0

Signatures

Detect Vidar Stealer 7 IoCs

stealer

resource	yara_rule
behavioral2/memory/568-2-0x0000000002510000-0x0000000002536000-memory.dmp	family_vidar_v7
behavioral2/memory/568-3-0x0000000000400000-0x00000000007CC000-memory.dmp	family_vidar_v7
behavioral2/memory/568-4-0x0000000000400000-0x00000000007CC000-memory.dmp	family_vidar_v7
behavioral2/memory/568-5-0x0000000000400000-0x00000000007CC000-memory.dmp	family_vidar_v7
behavioral2/memory/568-7-0x0000000002510000-0x0000000002536000-memory.dmp	family_vidar_v7
behavioral2/memory/568-21-0x0000000000400000-0x00000000007CC000-memory.dmp	family_vidar_v7
behavioral2/memory/568-22-0x0000000000400000-0x00000000007CC000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4964	568	WerFault.exe	89

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	97a504256f3e7627c02025fe05e4330d9d8fdf222db845371238da6dc75ddca1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	97a504256f3e7627c02025fe05e4330d9d8fdf222db845371238da6dc75ddca1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
568	97a504256f3e7627c02025fe05e4330d9d8fdf222db845371238da6dc75ddca1.exe
568	97a504256f3e7627c02025fe05e4330d9d8fdf222db845371238da6dc75ddca1.exe

C:\Users\Admin\AppData\Local\Temp\97a504256f3e7627c02025fe05e4330d9d8fdf222db845371238da6dc75ddca1.exe
"C:\Users\Admin\AppData\Local\Temp\97a504256f3e7627c02025fe05e4330d9d8fdf222db845371238da6dc75ddca1.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 904
  2⤵
  - Program crash
  PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 568 -ip 568
1⤵
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-1-0x0000000000960000-0x0000000000A60000-memory.dmp

Filesize
1024KB

Download
memory/568-2-0x0000000002510000-0x0000000002536000-memory.dmp

Filesize
152KB

Download
memory/568-3-0x0000000000400000-0x00000000007CC000-memory.dmp

Filesize
3.8MB

Download
memory/568-4-0x0000000000400000-0x00000000007CC000-memory.dmp

Filesize
3.8MB

Download
memory/568-5-0x0000000000400000-0x00000000007CC000-memory.dmp

Filesize
3.8MB

Download
memory/568-6-0x0000000000960000-0x0000000000A60000-memory.dmp

Filesize
1024KB

Download
memory/568-7-0x0000000002510000-0x0000000002536000-memory.dmp

Filesize
152KB

Download
memory/568-21-0x0000000000400000-0x00000000007CC000-memory.dmp

Filesize
3.8MB

Download
memory/568-22-0x0000000000400000-0x00000000007CC000-memory.dmp

Filesize
3.8MB

Download