vidar | 3207e4d698ac64dd7c30c1e1ce6247b6e2099e408f36832768cac8f3d7c36942

Analysis

max time kernel
92s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 327KB
Sample240418-mntbjaae75
SHA256 3207e4d698ac64dd7c30c1e1ce6247b6e2099e408f36832768cac8f3d7c36942
MD5 1cd2b133df1c0e1ace31e5ebd4622001
SHA1 ac9a2288a9f51daac2c9008ad91308aa63cacb2c
SHA512 57442da5248b22b9ec009ec118c2677f1979c978bd1ce77399206aed72e932a93ca98ca9784b375d7bdd07f6050b23d26f7a08c38952a1017cb15d262a682b85
SSDEEP 6144:fOLuCdfiVOMD4RKfCzVmc39hQQeUd3O4RPrGe5pic5WHwk4pQ:fOLufOszU5JqiWHH4pQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar stealer

Malware Config

Extracted

Family

vidar

https://steamcommunity.com/profiles/76561199673019888
https://t.me/irfail

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Signatures

Detect Vidar Stealer 5 IoCs

stealer

resource	yara_rule
behavioral2/memory/2076-1-0x00000000008A0000-0x00000000008F3000-memory.dmp	family_vidar_v7
behavioral2/memory/2176-0-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/2076-2-0x00000000008A0000-0x00000000008F3000-memory.dmp	family_vidar_v7
behavioral2/memory/2176-4-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/2176-6-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2076 set thread context of 2176	2076	file.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1248	2176	WerFault.exe	86

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2176	2076	file.exe	86
PID 2076 wrote to memory of 2176	2076	file.exe	86
PID 2076 wrote to memory of 2176	2076	file.exe	86
PID 2076 wrote to memory of 2176	2076	file.exe	86
PID 2076 wrote to memory of 2176	2076	file.exe	86
PID 2076 wrote to memory of 2176	2076	file.exe	86
PID 2076 wrote to memory of 2176	2076	file.exe	86
PID 2076 wrote to memory of 2176	2076	file.exe	86
PID 2076 wrote to memory of 2176	2076	file.exe	86
PID 2076 wrote to memory of 2176	2076	file.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 2116
    3⤵
    - Program crash
    PID:1248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2176 -ip 2176
1⤵
PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-1-0x00000000008A0000-0x00000000008F3000-memory.dmp

Download

memory/2076-2-0x00000000008A0000-0x00000000008F3000-memory.dmp

Download

memory/2176-0-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2176-4-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2176-6-0x0000000000400000-0x0000000000648000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads