vidar | b6b322636a7b1924641abe0e3d5e731e97c0552a8c408a6cd5fb0645799d47f7

Analysis

max time kernel
148s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

@#!!Newest_SoftWare_2024_P@SSCODE_%$/Setup.exe
Size

938KB
MD5

b15bac961f62448c872e1dc6d3931016
SHA1

1dcb61babb08fe5db711e379cb67335357a5db82
SHA256

bf1a0c67b433f52ebd304553f022baa34bfbca258c932d2b4b8b956b1467bfa5
SHA512

932119f7dc6710239481c80ad8baaed5c14a2085fcc514b6522671b1a4ebbaf488e43453f11d5aaf6dcef7a245db8de44d93ff255f7cf8385b7d00f31f2cc370
SSDEEP

24576:KjNRyoUXVwSCwfHACpA9EZkHx1KJ9ZiYwadzv:AzyLXVwPwfHACpAfRAhiYwadzv

Score

10^/10

vidar f98c5b0a7dd3573ec9aac41b4a67f845 stealer

Malware Config

Extracted

Family

vidar

Botnet

f98c5b0a7dd3573ec9aac41b4a67f845

https://redddog.xyz

https://steamcommunity.com/profiles/76561199677575543

https://t.me/snsb82

Attributes

profile_id_v2
f98c5b0a7dd3573ec9aac41b4a67f845
user_agent
Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/8.0.500.0 Safari/534.6

Signatures

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/2512-24-0x0000000000440000-0x0000000000B8C000-memory.dmp	family_vidar_v7
behavioral1/memory/2512-29-0x0000000000440000-0x0000000000B8C000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral1/memory/2512-24-0x0000000000440000-0x0000000000B8C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/memory/2512-29-0x0000000000440000-0x0000000000B8C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2276 set thread context of 2588	2276	Setup.exe	28

Loads dropped DLL 5 IoCs

pid	Process
2588	netsh.exe
2512	BvInputDiag.exe
2516	WerFault.exe
2516	WerFault.exe
2516	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	2512	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2276	Setup.exe
2276	Setup.exe
2588	netsh.exe
2588	netsh.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2276	Setup.exe
2588	netsh.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2588	2276	Setup.exe	28
PID 2276 wrote to memory of 2588	2276	Setup.exe	28
PID 2276 wrote to memory of 2588	2276	Setup.exe	28
PID 2276 wrote to memory of 2588	2276	Setup.exe	28
PID 2276 wrote to memory of 2588	2276	Setup.exe	28
PID 2588 wrote to memory of 2512	2588	netsh.exe	30
PID 2588 wrote to memory of 2512	2588	netsh.exe	30
PID 2588 wrote to memory of 2512	2588	netsh.exe	30
PID 2588 wrote to memory of 2512	2588	netsh.exe	30
PID 2588 wrote to memory of 2512	2588	netsh.exe	30
PID 2588 wrote to memory of 2512	2588	netsh.exe	30
PID 2512 wrote to memory of 2516	2512	BvInputDiag.exe	31
PID 2512 wrote to memory of 2516	2512	BvInputDiag.exe	31
PID 2512 wrote to memory of 2516	2512	BvInputDiag.exe	31
PID 2512 wrote to memory of 2516	2512	BvInputDiag.exe	31

C:\Users\Admin\AppData\Local\Temp\@#!!Newest_SoftWare_2024_P@SSCODE_%$\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\@#!!Newest_SoftWare_2024_P@SSCODE_%$\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\SysWOW64\netsh.exe
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Users\Admin\AppData\Local\Temp\BvInputDiag.exe
    C:\Users\Admin\AppData\Local\Temp\BvInputDiag.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 148
      4⤵
      Loads dropped DLL
      Program crash
      PID:2516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9072c6d4

Filesize
6.0MB

MD5
a8f13174490b1e9fcaa1195a2fbe5c2d

SHA1
a4cc822d292e43f9191e590f6867b28ba22c0420

SHA256
2f62bbbaf7fd282d2b252422e6bee084c955ada5756cbb11d20766f08593b74e

SHA512
d2902a602f13e8f89aa10ded0e611cfbf6d273dd564c98aab12d0b3df8fcfbac5c57d33106c72800f540a282a124e91803f0aabb82723a178da9e92380f15b2b

Download Submit
\Users\Admin\AppData\Local\Temp\BvInputDiag.exe

Filesize
136KB

MD5
3d754cfa4a5b2a3f19720550acf6d3cf

SHA1
e5c78edbd54e14a42258a6c223d2cf128530e1b6

SHA256
8e5e627881c8182bfbb64601c6f4f7b30ba950dfd10f638f404479406b2c03b8

SHA512
18db06443a718b8233ac9724e7f96310bf5841d2c980cd1d02e6fb6743e23acc13bd67fcd214b4c0650ac933f6f081759d699c73e14baf26ffc324c2b30f153b

Download Submit
memory/2276-8-0x0000000073DB0000-0x0000000073F24000-memory.dmp

Filesize
1.5MB

Download
memory/2276-9-0x0000000073DB0000-0x0000000073F24000-memory.dmp

Filesize
1.5MB

Download
memory/2276-7-0x0000000073DC2000-0x0000000073DC4000-memory.dmp

Filesize
8KB

Download
memory/2276-1-0x0000000076D50000-0x0000000076EF9000-memory.dmp

Filesize
1.7MB

Download
memory/2276-0-0x0000000073DB0000-0x0000000073F24000-memory.dmp

Filesize
1.5MB

Download
memory/2512-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2512-29-0x0000000000440000-0x0000000000B8C000-memory.dmp

Filesize
7.3MB

Download
memory/2512-24-0x0000000000440000-0x0000000000B8C000-memory.dmp

Filesize
7.3MB

Download
memory/2512-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2588-12-0x0000000073DB0000-0x0000000073F24000-memory.dmp

Filesize
1.5MB

Download
memory/2588-19-0x0000000073DB0000-0x0000000073F24000-memory.dmp

Filesize
1.5MB

Download
memory/2588-15-0x0000000073DB0000-0x0000000073F24000-memory.dmp

Filesize
1.5MB

Download
memory/2588-13-0x0000000076D50000-0x0000000076EF9000-memory.dmp

Filesize
1.7MB

Download