vidar | 7d69e0d82e74059115486fae5dd5ac6463c7fccd91dbbcaa9587117c7d201ddb

Resubmissions

22-04-2024 22:02

240422-1xtwbagh68 10

22-04-2024 19:25

240422-x42b7afa68 10

19-04-2024 03:02

240419-djmthsfh8w 10

Analysis

max time kernel
1483s
max time network
1499s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
22-04-2024 19:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe
Size

234KB
MD5

47573a5a6be2c7209517807e507f4e9c
SHA1

b0d0d999c9855c95f6c4e739b8d873ff4b6b940c
SHA256

3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5
SHA512

9bea8f64b374fcfd9dc343379b220bc71aa83090f5798eab229c511bd5ecb52c88c56d38b0f860ed410dc59bb19477216c99c961a87e291be262333fd8c3c99b
SSDEEP

6144:5qLFfq23vFmPFvyYrNFOqTOTWZ/gFOnWyqSwgcnRtabUAl:EN/EPFvPr3OI/gFT/SBJbUk

Score

10^/10

vidar stealer

Malware Config

Extracted

Family

vidar

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Signatures

Detect Vidar Stealer 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral31/memory/4504-4-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral31/memory/4504-7-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral31/memory/4504-9-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe

description	pid	process	target process
PID 4608 set thread context of 4504	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4696	4608	WerFault.exe	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe
3112	4504	WerFault.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe

description	pid	process	target process
PID 4608 wrote to memory of 2036	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe
PID 4608 wrote to memory of 2036	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe
PID 4608 wrote to memory of 2036	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe
PID 4608 wrote to memory of 480	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe
PID 4608 wrote to memory of 480	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe
PID 4608 wrote to memory of 480	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe
PID 4608 wrote to memory of 892	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe
PID 4608 wrote to memory of 892	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe
PID 4608 wrote to memory of 892	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe
PID 4608 wrote to memory of 4504	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe
PID 4608 wrote to memory of 4504	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe
PID 4608 wrote to memory of 4504	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe
PID 4608 wrote to memory of 4504	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe
PID 4608 wrote to memory of 4504	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe
PID 4608 wrote to memory of 4504	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe
PID 4608 wrote to memory of 4504	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe
PID 4608 wrote to memory of 4504	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe
PID 4608 wrote to memory of 4504	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe
PID 4608 wrote to memory of 4504	4608	3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe
"C:\Users\Admin\AppData\Local\Temp\3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:480
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:892
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 2100
    3⤵
    - Program crash
    PID:3112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 844
  2⤵
  - Program crash
  PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4608 -ip 4608
1⤵
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4504 -ip 4504
1⤵
PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4504-4-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/4504-7-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/4504-9-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/4608-0-0x0000000000B70000-0x0000000000BAC000-memory.dmp

Filesize
240KB

Download
memory/4608-1-0x0000000074580000-0x0000000074D31000-memory.dmp

Filesize
7.7MB

Download
memory/4608-10-0x0000000003130000-0x0000000005130000-memory.dmp

Filesize
32.0MB

Download
memory/4608-11-0x0000000074580000-0x0000000074D31000-memory.dmp

Filesize
7.7MB

Download