vidar | 4af66ae63601052bcac5f6a91d0d5be8469dedcb7e64cedc99afee7f8b44c7ac | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 19:35

Sharing

Report Analysis Logs

General

Target

file.exe
Size

400KB
MD5

5cab81fae61cb23017cc6c6eb6a7e433
SHA1

e7c299b308a01f140dc54496e20d87583d70a665
SHA256

4af66ae63601052bcac5f6a91d0d5be8469dedcb7e64cedc99afee7f8b44c7ac
SHA512

b033bb715d387a0f130453822138b7943a8f93a8fca20fbc115e8a82250e16ef7e5e8511f6db54da5f915dea6c92c2b6e8b8cfabf8a0a14d46e4ebf6b9d8ecc0
SSDEEP

12288:Xdy0t/5TvlNOThfN3TkbZdjjsYuo0C5pIs+y:x/5jl+7j4hjsY7J5Sr

Score

10^/10

vidar stealer

Malware Config

Signatures

Detect Vidar Stealer 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1152-0-0x0000000001250000-0x00000000012B9000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1288 1152 WerFault.exe file.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1152 wrote to memory of 1288	1152	file.exe	WerFault.exe
PID 1152 wrote to memory of 1288	1152	file.exe	WerFault.exe
PID 1152 wrote to memory of 1288	1152	file.exe	WerFault.exe
PID 1152 wrote to memory of 1288	1152	file.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 36
2⤵
- Program crash
PID:1288

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-0-0x0000000001250000-0x00000000012B9000-memory.dmp

Filesize
420KB

Download