vidar | 4af66ae63601052bcac5f6a91d0d5be8469dedcb7e64cedc99afee7f8b44c7ac

Analysis

max time kernel
55s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 19:35

Target

file.exe
Size

400KB
MD5

5cab81fae61cb23017cc6c6eb6a7e433
SHA1

e7c299b308a01f140dc54496e20d87583d70a665
SHA256

4af66ae63601052bcac5f6a91d0d5be8469dedcb7e64cedc99afee7f8b44c7ac
SHA512

b033bb715d387a0f130453822138b7943a8f93a8fca20fbc115e8a82250e16ef7e5e8511f6db54da5f915dea6c92c2b6e8b8cfabf8a0a14d46e4ebf6b9d8ecc0
SSDEEP

12288:Xdy0t/5TvlNOThfN3TkbZdjjsYuo0C5pIs+y:x/5jl+7j4hjsY7J5Sr

Score

10^/10

vidar stealer

Family

vidar

https://steamcommunity.com/profiles/76561199677575543

https://t.me/snsb82

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Detect Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/3756-0-0x00000000004B0000-0x0000000000519000-memory.dmp	family_vidar_v7
behavioral2/memory/1148-4-0x0000000000400000-0x000000000064A000-memory.dmp	family_vidar_v7
behavioral2/memory/1148-5-0x0000000000400000-0x000000000064A000-memory.dmp	family_vidar_v7
behavioral2/memory/3756-6-0x00000000004B0000-0x0000000000519000-memory.dmp	family_vidar_v7
behavioral2/memory/1148-1-0x0000000000400000-0x000000000064A000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 3756 set thread context of 1148 3756 file.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2976 1148 WerFault.exe RegAsm.exe

description	pid	process	target process
PID 3756 set thread context of 1148	3756	file.exe	RegAsm.exe

pid	pid_target	process	target process
2976	1148	WerFault.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

file.exe

description	pid	process	target process
PID 3756 wrote to memory of 1148	3756	file.exe	RegAsm.exe
PID 3756 wrote to memory of 1148	3756	file.exe	RegAsm.exe
PID 3756 wrote to memory of 1148	3756	file.exe	RegAsm.exe
PID 3756 wrote to memory of 1148	3756	file.exe	RegAsm.exe
PID 3756 wrote to memory of 1148	3756	file.exe	RegAsm.exe
PID 3756 wrote to memory of 1148	3756	file.exe	RegAsm.exe
PID 3756 wrote to memory of 1148	3756	file.exe	RegAsm.exe
PID 3756 wrote to memory of 1148	3756	file.exe	RegAsm.exe
PID 3756 wrote to memory of 1148	3756	file.exe	RegAsm.exe
PID 3756 wrote to memory of 1148	3756	file.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 1472
3⤵
- Program crash
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1148 -ip 1148
1⤵
PID:1304

memory/1148-4-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/1148-5-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/1148-1-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/3756-0-0x00000000004B0000-0x0000000000519000-memory.dmp

Filesize
420KB

Download
memory/3756-6-0x00000000004B0000-0x0000000000519000-memory.dmp

Filesize
420KB

Download