vidar | 50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0

General

Target

50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe
Size

4.3MB
MD5

6d59b75f2b8bf7590c144cd4b3d24516
SHA1

6325d9ea89692248cf599493743f637b7fefe726
SHA256

50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0
SHA512

77f29661bee56bd26e11abd359b1e01e23d76994cab99528242bd08b77c3c8be810b07855f76ef6394ae5a43b907cccb421fc525870b03f4afc1c7664607931a
SSDEEP

49152:fc6PM2ku7KoRtVYIN9uCftMVtWf+NSzuHI791x4Ayjxw2PjCSK6Q70zPbyg8L3bn:fc6p37V9Bfa3Wf+N3I7Xx43byg8ua

Score

10^/10

vidar zgrat rat stealer

Malware Config

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199673019888

https://t.me/irfail

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Signatures

Detect Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral2/memory/884-21-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/884-24-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/884-26-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/884-30-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/4652-1-0x0000000000500000-0x0000000000946000-memory.dmp	family_zgrat_v1

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Loads dropped DLL 1 IoCs

pid	Process
4652	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4652 set thread context of 884	4652	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	94

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3228	884	WerFault.exe	94

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 3084	4652	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	93
PID 4652 wrote to memory of 3084	4652	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	93
PID 4652 wrote to memory of 3084	4652	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	93
PID 4652 wrote to memory of 884	4652	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	94
PID 4652 wrote to memory of 884	4652	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	94
PID 4652 wrote to memory of 884	4652	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	94
PID 4652 wrote to memory of 884	4652	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	94
PID 4652 wrote to memory of 884	4652	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	94
PID 4652 wrote to memory of 884	4652	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	94
PID 4652 wrote to memory of 884	4652	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	94
PID 4652 wrote to memory of 884	4652	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	94
PID 4652 wrote to memory of 884	4652	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	94
PID 4652 wrote to memory of 884	4652	50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe	94

C:\Users\Admin\AppData\Local\Temp\50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe
"C:\Users\Admin\AppData\Local\Temp\50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:3084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 1968
    3⤵
    - Program crash
    PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 884 -ip 884
1⤵
PID:2284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/884-30-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/884-26-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/884-24-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/884-21-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/4652-14-0x0000000005170000-0x0000000005180000-memory.dmp

Filesize
64KB

Download
memory/4652-18-0x00000000059F0000-0x0000000005AF0000-memory.dmp

Filesize
1024KB

Download
memory/4652-11-0x0000000005170000-0x0000000005180000-memory.dmp

Filesize
64KB

Download
memory/4652-12-0x0000000005170000-0x0000000005180000-memory.dmp

Filesize
64KB

Download
memory/4652-13-0x0000000005170000-0x0000000005180000-memory.dmp

Filesize
64KB

Download
memory/4652-0-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/4652-15-0x0000000005820000-0x0000000005830000-memory.dmp

Filesize
64KB

Download
memory/4652-16-0x0000000005170000-0x0000000005180000-memory.dmp

Filesize
64KB

Download
memory/4652-17-0x0000000005170000-0x0000000005180000-memory.dmp

Filesize
64KB

Download
memory/4652-5-0x0000000005500000-0x0000000005692000-memory.dmp

Filesize
1.6MB

Download
memory/4652-19-0x00000000059F0000-0x0000000005AF0000-memory.dmp

Filesize
1024KB

Download
memory/4652-20-0x00000000059F0000-0x0000000005AF0000-memory.dmp

Filesize
1024KB

Download
memory/4652-4-0x0000000005170000-0x0000000005180000-memory.dmp

Filesize
64KB

Download
memory/4652-25-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/4652-3-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/4652-2-0x00000000052B0000-0x000000000534C000-memory.dmp

Filesize
624KB

Download
memory/4652-1-0x0000000000500000-0x0000000000946000-memory.dmp

Filesize
4.3MB

Download

Analysis

Sharing