vidar | b6b322636a7b1924641abe0e3d5e731e97c0552a8c408a6cd5fb0645799d47f7

Analysis

max time kernel
148s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
@#!!Newest_SoftWare_2024_P@SSCODE_%$/Setup.exe
Size 938KB
Sample240502-cfmtnsga97
SHA256 bf1a0c67b433f52ebd304553f022baa34bfbca258c932d2b4b8b956b1467bfa5
MD5 b15bac961f62448c872e1dc6d3931016
SHA1 1dcb61babb08fe5db711e379cb67335357a5db82
SHA512 932119f7dc6710239481c80ad8baaed5c14a2085fcc514b6522671b1a4ebbaf488e43453f11d5aaf6dcef7a245db8de44d93ff255f7cf8385b7d00f31f2cc370
SSDEEP 24576:KjNRyoUXVwSCwfHACpA9EZkHx1KJ9ZiYwadzv:AzyLXVwPwfHACpAfRAhiYwadzv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar f98c5b0a7dd3573ec9aac41b4a67f845 stealer

Malware Config

Extracted

Family

vidar

Botnet

f98c5b0a7dd3573ec9aac41b4a67f845

https://redddog.xyz
https://steamcommunity.com/profiles/76561199677575543
https://t.me/snsb82

Attributes

profile_id_v2
f98c5b0a7dd3573ec9aac41b4a67f845
user_agent
Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/8.0.500.0 Safari/534.6

Signatures

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/2512-24-0x0000000000440000-0x0000000000B8C000-memory.dmp	family_vidar_v7
behavioral1/memory/2512-29-0x0000000000440000-0x0000000000B8C000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral1/memory/2512-24-0x0000000000440000-0x0000000000B8C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/memory/2512-29-0x0000000000440000-0x0000000000B8C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2276 set thread context of 2588	2276	Setup.exe	28

Loads dropped DLL 5 IoCs

pid	Process
2588	netsh.exe
2512	BvInputDiag.exe
2516	WerFault.exe
2516	WerFault.exe
2516	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	2512	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2276	Setup.exe
2276	Setup.exe
2588	netsh.exe
2588	netsh.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2276	Setup.exe
2588	netsh.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2588	2276	Setup.exe	28
PID 2276 wrote to memory of 2588	2276	Setup.exe	28
PID 2276 wrote to memory of 2588	2276	Setup.exe	28
PID 2276 wrote to memory of 2588	2276	Setup.exe	28
PID 2276 wrote to memory of 2588	2276	Setup.exe	28
PID 2588 wrote to memory of 2512	2588	netsh.exe	30
PID 2588 wrote to memory of 2512	2588	netsh.exe	30
PID 2588 wrote to memory of 2512	2588	netsh.exe	30
PID 2588 wrote to memory of 2512	2588	netsh.exe	30
PID 2588 wrote to memory of 2512	2588	netsh.exe	30
PID 2588 wrote to memory of 2512	2588	netsh.exe	30
PID 2512 wrote to memory of 2516	2512	BvInputDiag.exe	31
PID 2512 wrote to memory of 2516	2512	BvInputDiag.exe	31
PID 2512 wrote to memory of 2516	2512	BvInputDiag.exe	31
PID 2512 wrote to memory of 2516	2512	BvInputDiag.exe	31

C:\Users\Admin\AppData\Local\Temp\@#!!Newest_SoftWare_2024_P@SSCODE_%$\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\@#!!Newest_SoftWare_2024_P@SSCODE_%$\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\SysWOW64\netsh.exe
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Users\Admin\AppData\Local\Temp\BvInputDiag.exe
    C:\Users\Admin\AppData\Local\Temp\BvInputDiag.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 148
      4⤵
      Loads dropped DLL
      Program crash
      PID:2516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

9072c6d4

Path C:\Users\Admin\AppData\Local\Temp\9072c6d4
Size 6.0MB
SHA256 2f62bbbaf7fd282d2b252422e6bee084c955ada5756cbb11d20766f08593b74e
MD5 a8f13174490b1e9fcaa1195a2fbe5c2d
SHA1 a4cc822d292e43f9191e590f6867b28ba22c0420
SHA512 d2902a602f13e8f89aa10ded0e611cfbf6d273dd564c98aab12d0b3df8fcfbac5c57d33106c72800f540a282a124e91803f0aabb82723a178da9e92380f15b2b
SSDEEP 196608:YfwNkTLOR6aRUeA6KFIu+n0o/Zy3VY+6kH9gBBXx:/NHoarKF9Lo/Zy3q9Xx
MD5 SHA1 SHA512 SSDEEP

Submit Download

BvInputDiag.exe

Path \Users\Admin\AppData\Local\Temp\BvInputDiag.exe
Size 136KB
SHA256 8e5e627881c8182bfbb64601c6f4f7b30ba950dfd10f638f404479406b2c03b8
MD5 3d754cfa4a5b2a3f19720550acf6d3cf
SHA1 e5c78edbd54e14a42258a6c223d2cf128530e1b6
SHA512 18db06443a718b8233ac9724e7f96310bf5841d2c980cd1d02e6fb6743e23acc13bd67fcd214b4c0650ac933f6f081759d699c73e14baf26ffc324c2b30f153b
SSDEEP 1536:G5stnXTXfKE+8gKuaFIe5BikUxaAahi7M8PD0RTr+jSxtOoh3xifOoh46xKl:06njPKE+8xvUx84cGEOomfOoOjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2276-8-0x0000000073DB0000-0x0000000073F24000-memory.dmp

Download

memory/2276-9-0x0000000073DB0000-0x0000000073F24000-memory.dmp

Download

memory/2276-7-0x0000000073DC2000-0x0000000073DC4000-memory.dmp

Download

memory/2276-1-0x0000000076D50000-0x0000000076EF9000-memory.dmp

Download

memory/2276-0-0x0000000073DB0000-0x0000000073F24000-memory.dmp

Download

memory/2512-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2512-29-0x0000000000440000-0x0000000000B8C000-memory.dmp

Download

memory/2512-24-0x0000000000440000-0x0000000000B8C000-memory.dmp

Download

memory/2512-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2588-12-0x0000000073DB0000-0x0000000073F24000-memory.dmp

Download

memory/2588-19-0x0000000073DB0000-0x0000000073F24000-memory.dmp

Download

memory/2588-15-0x0000000073DB0000-0x0000000073F24000-memory.dmp

Download

memory/2588-13-0x0000000076D50000-0x0000000076EF9000-memory.dmp

Download