vidar | 50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0

General

Target

50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe
Size

4.3MB
MD5

6d59b75f2b8bf7590c144cd4b3d24516
SHA1

6325d9ea89692248cf599493743f637b7fefe726
SHA256

50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0
SHA512

77f29661bee56bd26e11abd359b1e01e23d76994cab99528242bd08b77c3c8be810b07855f76ef6394ae5a43b907cccb421fc525870b03f4afc1c7664607931a
SSDEEP

49152:fc6PM2ku7KoRtVYIN9uCftMVtWf+NSzuHI791x4Ayjxw2PjCSK6Q70zPbyg8L3bn:fc6p37V9Bfa3Wf+N3I7Xx43byg8ua

Score

10^/10

vidar zgrat rat stealer

Malware Config

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199673019888

https://t.me/irfail

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Signatures

Detect Vidar Stealer 7 IoCs

stealer

resource	yara_rule
behavioral1/memory/2560-25-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral1/memory/2560-27-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral1/memory/2560-29-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral1/memory/2560-32-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral1/memory/2560-35-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral1/memory/2560-36-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral1/memory/2560-175-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2244-1-0x0000000000210000-0x0000000000656000-memory.dmp	family_zgrat_v1

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Loads dropped DLL 1 IoCs

pid	Process
2244	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2244 set thread context of 2560	2244	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1120	2560	WerFault.exe	30

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2560	2244	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	30
PID 2244 wrote to memory of 2560	2244	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	30
PID 2244 wrote to memory of 2560	2244	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	30
PID 2244 wrote to memory of 2560	2244	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	30
PID 2244 wrote to memory of 2560	2244	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	30
PID 2244 wrote to memory of 2560	2244	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	30
PID 2244 wrote to memory of 2560	2244	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	30
PID 2244 wrote to memory of 2560	2244	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	30
PID 2244 wrote to memory of 2560	2244	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	30
PID 2244 wrote to memory of 2560	2244	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	30
PID 2244 wrote to memory of 2560	2244	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	30
PID 2560 wrote to memory of 1120	2560	MsBuild.exe	34
PID 2560 wrote to memory of 1120	2560	MsBuild.exe	34
PID 2560 wrote to memory of 1120	2560	MsBuild.exe	34
PID 2560 wrote to memory of 1120	2560	MsBuild.exe	34

C:\Users\Admin\AppData\Local\Temp\50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe
"C:\Users\Admin\AppData\Local\Temp\50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 1420
    3⤵
    - Program crash
    PID:1120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar236F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/2244-18-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2244-13-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2244-3-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2244-9-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2244-10-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2244-11-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2244-12-0x0000000000780000-0x0000000000790000-memory.dmp

Filesize
64KB

Download
memory/2244-34-0x0000000074050000-0x000000007473E000-memory.dmp

Filesize
6.9MB

Download
memory/2244-14-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2244-15-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2244-16-0x0000000005910000-0x0000000005A10000-memory.dmp

Filesize
1024KB

Download
memory/2244-1-0x0000000000210000-0x0000000000656000-memory.dmp

Filesize
4.3MB

Download
memory/2244-17-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2244-4-0x00000000055F0000-0x0000000005782000-memory.dmp

Filesize
1.6MB

Download
memory/2244-0-0x0000000074050000-0x000000007473E000-memory.dmp

Filesize
6.9MB

Download
memory/2244-2-0x0000000074050000-0x000000007473E000-memory.dmp

Filesize
6.9MB

Download
memory/2560-19-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/2560-27-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/2560-29-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/2560-32-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/2560-25-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/2560-31-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2560-35-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/2560-36-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/2560-23-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/2560-21-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/2560-175-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing