vidar | 998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2024 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe
Size

350KB
MD5

c144f16a3e3aff33fc958fdea42df7e0
SHA1

470f6863ce73dbfd88441dc2c06e55d6ab3a96f6
SHA256

998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac
SHA512

6193661166530b6e923c1de242112c3e90d7562fce979d7d4933f49b61954a407badba5ddc0833ff00907b64b78e2a84630a3be8ba7ff18147d875f3f2b54e2a
SSDEEP

3072:y8RfADp0Sf7qbe+sXJZXAksI2opQJy1Im2VlzlVHu2rC86PlFEVSmkfQIkp7Kgtv:MDqy/PLIoqJyrY3c2G8yXmpIyKE1c

Score

10^/10

vidar stealer

Malware Config

Extracted

Family

vidar

https://steamcommunity.com/profiles/76561199677575543

https://t.me/snsb82

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Signatures

Detect Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/3048-2-0x0000000004500000-0x0000000004536000-memory.dmp	family_vidar_v7
behavioral1/memory/3640-5-0x0000000000400000-0x000000000064A000-memory.dmp	family_vidar_v7
behavioral1/memory/3640-6-0x0000000000400000-0x000000000064A000-memory.dmp	family_vidar_v7
behavioral1/memory/3640-3-0x0000000000400000-0x000000000064A000-memory.dmp	family_vidar_v7
behavioral1/memory/3640-10-0x0000000000400000-0x000000000064A000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe

description	pid	process	target process
PID 3048 set thread context of 3640	3048	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2180 3640 WerFault.exe 998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe

pid	pid_target	process	target process
2180	3640	WerFault.exe	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe

description	pid	process	target process
PID 3048 wrote to memory of 3640	3048	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe
PID 3048 wrote to memory of 3640	3048	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe
PID 3048 wrote to memory of 3640	3048	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe
PID 3048 wrote to memory of 3640	3048	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe
PID 3048 wrote to memory of 3640	3048	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe
PID 3048 wrote to memory of 3640	3048	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe
PID 3048 wrote to memory of 3640	3048	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe
PID 3048 wrote to memory of 3640	3048	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe
PID 3048 wrote to memory of 3640	3048	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe
PID 3048 wrote to memory of 3640	3048	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe	998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe

C:\Users\Admin\AppData\Local\Temp\998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe
"C:\Users\Admin\AppData\Local\Temp\998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3048

C:\Users\Admin\AppData\Local\Temp\998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe
"C:\Users\Admin\AppData\Local\Temp\998c38a88197ab545ed66959130ba09db2359000da1fe5b6af913a33d5902cac.exe"
2⤵
PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 316
3⤵
- Program crash
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3640 -ip 3640
1⤵
PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-1-0x0000000004060000-0x0000000004160000-memory.dmp

Filesize
1024KB

Download
memory/3048-2-0x0000000004500000-0x0000000004536000-memory.dmp

Filesize
216KB

Download
memory/3640-5-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/3640-6-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/3640-3-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/3640-10-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download