vidar | b6b322636a7b1924641abe0e3d5e731e97c0552a8c408a6cd5fb0645799d47f7

Analysis

max time kernel
140s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

@#!!Newest_SoftWare_2024_P@SSCODE_%$/Setup.exe
Size

938KB
MD5

b15bac961f62448c872e1dc6d3931016
SHA1

1dcb61babb08fe5db711e379cb67335357a5db82
SHA256

bf1a0c67b433f52ebd304553f022baa34bfbca258c932d2b4b8b956b1467bfa5
SHA512

932119f7dc6710239481c80ad8baaed5c14a2085fcc514b6522671b1a4ebbaf488e43453f11d5aaf6dcef7a245db8de44d93ff255f7cf8385b7d00f31f2cc370
SSDEEP

24576:KjNRyoUXVwSCwfHACpA9EZkHx1KJ9ZiYwadzv:AzyLXVwPwfHACpAfRAhiYwadzv

Score

10^/10

vidar f98c5b0a7dd3573ec9aac41b4a67f845 stealer

Malware Config

Extracted

Family

vidar

Botnet

f98c5b0a7dd3573ec9aac41b4a67f845

https://redddog.xyz

https://steamcommunity.com/profiles/76561199677575543

https://t.me/snsb82

Attributes

profile_id_v2
f98c5b0a7dd3573ec9aac41b4a67f845
user_agent
Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/8.0.500.0 Safari/534.6

Signatures

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/1504-23-0x0000000000900000-0x000000000104C000-memory.dmp	family_vidar_v7
behavioral2/memory/1504-32-0x0000000000900000-0x000000000104C000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/memory/1504-32-0x0000000000900000-0x000000000104C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/memory/1504-32-0x0000000000900000-0x000000000104C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
behavioral2/memory/1504-32-0x0000000000900000-0x000000000104C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral2/memory/1504-23-0x0000000000900000-0x000000000104C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1504-32-0x0000000000900000-0x000000000104C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 916 set thread context of 5016	916	Setup.exe	86

Loads dropped DLL 1 IoCs

pid	Process
1504	BvInputDiag.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4588	1504	WerFault.exe	97

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
916	Setup.exe
916	Setup.exe
5016	netsh.exe
5016	netsh.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
916	Setup.exe
5016	netsh.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 5016	916	Setup.exe	86
PID 916 wrote to memory of 5016	916	Setup.exe	86
PID 916 wrote to memory of 5016	916	Setup.exe	86
PID 916 wrote to memory of 5016	916	Setup.exe	86
PID 5016 wrote to memory of 1504	5016	netsh.exe	97
PID 5016 wrote to memory of 1504	5016	netsh.exe	97
PID 5016 wrote to memory of 1504	5016	netsh.exe	97
PID 5016 wrote to memory of 1504	5016	netsh.exe	97
PID 5016 wrote to memory of 1504	5016	netsh.exe	97

C:\Users\Admin\AppData\Local\Temp\@#!!Newest_SoftWare_2024_P@SSCODE_%$\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\@#!!Newest_SoftWare_2024_P@SSCODE_%$\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\SysWOW64\netsh.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Users\Admin\AppData\Local\Temp\BvInputDiag.exe
    C:\Users\Admin\AppData\Local\Temp\BvInputDiag.exe
    3⤵
    - Loads dropped DLL
    PID:1504
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1892
      4⤵
      Program crash
      PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1504 -ip 1504
1⤵
PID:4340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\99b20255

Filesize
6.0MB

MD5
49811e88bfe0d39bb4f9625bbd072de7

SHA1
1e0510637750684f89148ced19b15d0de2fac2ec

SHA256
46c19acbc2eb7dee528230071e73d892d420408128e073903a1931efbf5f6939

SHA512
eb98ae7832dba7c2011e9db772c1b074e4c3df38cb7f03b878177d971453a003651e285dcb906fc787c13337e064141aa110d01a110e73ee1991b89c58216e65

Download Submit
C:\Users\Admin\AppData\Local\Temp\BvInputDiag.exe

Filesize
136KB

MD5
3d754cfa4a5b2a3f19720550acf6d3cf

SHA1
e5c78edbd54e14a42258a6c223d2cf128530e1b6

SHA256
8e5e627881c8182bfbb64601c6f4f7b30ba950dfd10f638f404479406b2c03b8

SHA512
18db06443a718b8233ac9724e7f96310bf5841d2c980cd1d02e6fb6743e23acc13bd67fcd214b4c0650ac933f6f081759d699c73e14baf26ffc324c2b30f153b

Download Submit
memory/916-8-0x0000000073FE0000-0x000000007415B000-memory.dmp

Filesize
1.5MB

Download
memory/916-0-0x0000000073FE0000-0x000000007415B000-memory.dmp

Filesize
1.5MB

Download
memory/916-9-0x0000000073FE0000-0x000000007415B000-memory.dmp

Filesize
1.5MB

Download
memory/916-7-0x0000000073FF2000-0x0000000073FF4000-memory.dmp

Filesize
8KB

Download
memory/916-1-0x00007FFFBD190000-0x00007FFFBD385000-memory.dmp

Filesize
2.0MB

Download
memory/1504-23-0x0000000000900000-0x000000000104C000-memory.dmp

Filesize
7.3MB

Download
memory/1504-25-0x00007FFFBD190000-0x00007FFFBD385000-memory.dmp

Filesize
2.0MB

Download
memory/1504-32-0x0000000000900000-0x000000000104C000-memory.dmp

Filesize
7.3MB

Download
memory/5016-11-0x0000000073FE1000-0x0000000073FEF000-memory.dmp

Filesize
56KB

Download
memory/5016-13-0x00007FFFBD190000-0x00007FFFBD385000-memory.dmp

Filesize
2.0MB

Download
memory/5016-16-0x0000000073FEE000-0x0000000073FF0000-memory.dmp

Filesize
8KB

Download
memory/5016-17-0x0000000073FE1000-0x0000000073FEF000-memory.dmp

Filesize
56KB

Download
memory/5016-20-0x0000000073FE1000-0x0000000073FEF000-memory.dmp

Filesize
56KB

Download