vidar | c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d

Analysis

max time kernel
79s
max time network
188s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
29/04/2024, 04:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d.exe
Size

1.1MB
MD5

e8fb1dcc97722ad439de6efc099b194b
SHA1

e8357ab6e08fdab3efc57ab79d6e00c993360bd5
SHA256

c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d
SHA512

ac75c0887b834fafe3a40960c2a66c1e35f13ae8018664b1ad67308099191c7c35780a698ebf7632938903e6f2ad4729259586398f3b5315e7fd9c3a6bd647b3
SSDEEP

24576:1iQqpWJvGp290y91Er1TianF/C8OPW7G/3oK:fqVp290y91Erp/C8AWy/4K

Score

10^/10

vidar stealer

Malware Config

Extracted

Family

vidar

https://steamcommunity.com/profiles/76561199673019888

https://t.me/irfail

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Extracted

Family

vidar

Version

RoInitialize

Signatures

Detect Vidar Stealer 5 IoCs

stealer

resource	yara_rule
behavioral2/memory/1260-0-0x0000000001380000-0x0000000001492000-memory.dmp	family_vidar_v7
behavioral2/memory/1260-2-0x0000000001380000-0x0000000001492000-memory.dmp	family_vidar_v7
behavioral2/memory/1008-1-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/1008-6-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/1008-4-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1260 set thread context of 1008	1260	c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d.exe	74

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4404	1008	WerFault.exe	74

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 3952	1260	c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d.exe	73
PID 1260 wrote to memory of 3952	1260	c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d.exe	73
PID 1260 wrote to memory of 3952	1260	c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d.exe	73
PID 1260 wrote to memory of 1008	1260	c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d.exe	74
PID 1260 wrote to memory of 1008	1260	c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d.exe	74
PID 1260 wrote to memory of 1008	1260	c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d.exe	74
PID 1260 wrote to memory of 1008	1260	c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d.exe	74
PID 1260 wrote to memory of 1008	1260	c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d.exe	74
PID 1260 wrote to memory of 1008	1260	c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d.exe	74
PID 1260 wrote to memory of 1008	1260	c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d.exe	74
PID 1260 wrote to memory of 1008	1260	c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d.exe	74
PID 1260 wrote to memory of 1008	1260	c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d.exe	74
PID 1260 wrote to memory of 1008	1260	c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d.exe	74

C:\Users\Admin\AppData\Local\Temp\c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d.exe
"C:\Users\Admin\AppData\Local\Temp\c5438e18784db1b879a78a5a7f890d225654b8bdee573a88903f1191d533f94d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3952
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 1616
    3⤵
    - Program crash
    PID:4404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1008-1-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/1008-6-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/1008-4-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/1260-0-0x0000000001380000-0x0000000001492000-memory.dmp

Filesize
1.1MB

Download
memory/1260-2-0x0000000001380000-0x0000000001492000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads