vidar | e49fbe983f9657085fd6ed87ef01d3d80b8c89fc15e159e227e661c8a9f76704 | Triage

Analysis

max time kernel
66s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 22:30

Sharing

Report Analysis Logs

General

Target

file.exe
Size

393KB
MD5

b96f9d010e1c6150e78bd217212f2854
SHA1

c43a35a08db7358281d25a2f0134d41eb37a3ae8
SHA256

e49fbe983f9657085fd6ed87ef01d3d80b8c89fc15e159e227e661c8a9f76704
SHA512

956b90536bb9fa138854a1e47313219b117485708a20e110946682eff972a8e0ee396041b13b1cc03f103989f3029cf59e55ea0b17940ffd8be50dd3f4f2252d
SSDEEP

6144:nGVRPs+yOtDqvFTbTEw3A9YkXw44ExQF9K6H6E+gyVMjM20vK2Bss5YjP:8RPs+yOo2h9YExQW6HziMw2DGss2jP

Score

10^/10

vidar stealer

Malware Config

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199677575543

https://t.me/snsb82

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Signatures

Detect Vidar Stealer 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1120-0-0x0000000000400000-0x000000000064A000-memory.dmp	family_vidar_v7
behavioral2/memory/2768-2-0x00000000002C0000-0x0000000000327000-memory.dmp	family_vidar_v7
behavioral2/memory/1120-4-0x0000000000400000-0x000000000064A000-memory.dmp	family_vidar_v7
behavioral2/memory/1120-6-0x0000000000400000-0x000000000064A000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 2768 set thread context of 1120 2768 file.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2340 1120 WerFault.exe RegAsm.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

file.exe

description	pid	process	target process
PID 2768 wrote to memory of 1120	2768	file.exe	RegAsm.exe
PID 2768 wrote to memory of 1120	2768	file.exe	RegAsm.exe
PID 2768 wrote to memory of 1120	2768	file.exe	RegAsm.exe
PID 2768 wrote to memory of 1120	2768	file.exe	RegAsm.exe
PID 2768 wrote to memory of 1120	2768	file.exe	RegAsm.exe
PID 2768 wrote to memory of 1120	2768	file.exe	RegAsm.exe
PID 2768 wrote to memory of 1120	2768	file.exe	RegAsm.exe
PID 2768 wrote to memory of 1120	2768	file.exe	RegAsm.exe
PID 2768 wrote to memory of 1120	2768	file.exe	RegAsm.exe
PID 2768 wrote to memory of 1120	2768	file.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 1488
    3⤵
    - Program crash
    PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1120 -ip 1120
1⤵
PID:1928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-0-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/1120-4-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/1120-6-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/2768-2-0x00000000002C0000-0x0000000000327000-memory.dmp

Filesize
412KB

Download