vidar | 9ce8c75892fbdc4793558467d98e05b17459cdce4078b0fb7c270495d195d747

Analysis

max time kernel
94s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 01:45

Target

9ce8c75892fbdc4793558467d98e05b17459cdce4078b0fb7c270495d195d747.exe
Size

422KB
MD5

03750d84804cd05a1e7366dd52e67f71
SHA1

c64e12d70a131e168d54e4074c3a11668779381d
SHA256

9ce8c75892fbdc4793558467d98e05b17459cdce4078b0fb7c270495d195d747
SHA512

bcffeebef54e05fac8b7ef3c8d491a686c8de0f5a00f8bf94f9486fb5091e1a916bc491256bf58a6751f9d128c4d9148bad97a3d459976862f26104d6988e4f7
SSDEEP

6144:29KDb7RpkvFCCTnOPivspTpwlHe6EiZ1gFrzTt8ceX7seXztApIvejJXcxQC:zb7RpkMCsppwlRgFXG9XdtOp5ciC

Score

10^/10

vidar stealer

Family

vidar

https://steamcommunity.com/profiles/76561199677575543

https://t.me/snsb82

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Detect Vidar Stealer 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/1900-1-0x0000000000E30000-0x0000000000E9E000-memory.dmp	family_vidar_v7
behavioral2/memory/392-0-0x0000000000400000-0x000000000064A000-memory.dmp	family_vidar_v7
behavioral2/memory/392-6-0x0000000000400000-0x000000000064A000-memory.dmp	family_vidar_v7
behavioral2/memory/392-4-0x0000000000400000-0x000000000064A000-memory.dmp	family_vidar_v7

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1900-1-0x0000000000E30000-0x0000000000E9E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/392-0-0x0000000000400000-0x000000000064A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/392-6-0x0000000000400000-0x000000000064A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/392-4-0x0000000000400000-0x000000000064A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Suspicious use of SetThreadContext 1 IoCs

Processes:

9ce8c75892fbdc4793558467d98e05b17459cdce4078b0fb7c270495d195d747.exe

description	pid	process	target process
PID 1900 set thread context of 392	1900	9ce8c75892fbdc4793558467d98e05b17459cdce4078b0fb7c270495d195d747.exe	RegAsm.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1484 392 WerFault.exe RegAsm.exe

pid	pid_target	process	target process
1484	392	WerFault.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

9ce8c75892fbdc4793558467d98e05b17459cdce4078b0fb7c270495d195d747.exe

description	pid	process	target process
PID 1900 wrote to memory of 392	1900	9ce8c75892fbdc4793558467d98e05b17459cdce4078b0fb7c270495d195d747.exe	RegAsm.exe
PID 1900 wrote to memory of 392	1900	9ce8c75892fbdc4793558467d98e05b17459cdce4078b0fb7c270495d195d747.exe	RegAsm.exe
PID 1900 wrote to memory of 392	1900	9ce8c75892fbdc4793558467d98e05b17459cdce4078b0fb7c270495d195d747.exe	RegAsm.exe
PID 1900 wrote to memory of 392	1900	9ce8c75892fbdc4793558467d98e05b17459cdce4078b0fb7c270495d195d747.exe	RegAsm.exe
PID 1900 wrote to memory of 392	1900	9ce8c75892fbdc4793558467d98e05b17459cdce4078b0fb7c270495d195d747.exe	RegAsm.exe
PID 1900 wrote to memory of 392	1900	9ce8c75892fbdc4793558467d98e05b17459cdce4078b0fb7c270495d195d747.exe	RegAsm.exe
PID 1900 wrote to memory of 392	1900	9ce8c75892fbdc4793558467d98e05b17459cdce4078b0fb7c270495d195d747.exe	RegAsm.exe
PID 1900 wrote to memory of 392	1900	9ce8c75892fbdc4793558467d98e05b17459cdce4078b0fb7c270495d195d747.exe	RegAsm.exe
PID 1900 wrote to memory of 392	1900	9ce8c75892fbdc4793558467d98e05b17459cdce4078b0fb7c270495d195d747.exe	RegAsm.exe
PID 1900 wrote to memory of 392	1900	9ce8c75892fbdc4793558467d98e05b17459cdce4078b0fb7c270495d195d747.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 2124
3⤵
- Program crash
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 392 -ip 392
1⤵
PID:5020

memory/392-0-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/392-6-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/392-4-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/1900-1-0x0000000000E30000-0x0000000000E9E000-memory.dmp

Filesize
440KB

Download