vidar | b6b322636a7b1924641abe0e3d5e731e97c0552a8c408a6cd5fb0645799d47f7

Analysis

max time kernel
140s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
@#!!Newest_SoftWare_2024_P@SSCODE_%$/Setup.exe
Size 938KB
Sample240502-cfmtnsga97
SHA256 bf1a0c67b433f52ebd304553f022baa34bfbca258c932d2b4b8b956b1467bfa5
MD5 b15bac961f62448c872e1dc6d3931016
SHA1 1dcb61babb08fe5db711e379cb67335357a5db82
SHA512 932119f7dc6710239481c80ad8baaed5c14a2085fcc514b6522671b1a4ebbaf488e43453f11d5aaf6dcef7a245db8de44d93ff255f7cf8385b7d00f31f2cc370
SSDEEP 24576:KjNRyoUXVwSCwfHACpA9EZkHx1KJ9ZiYwadzv:AzyLXVwPwfHACpAfRAhiYwadzv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar f98c5b0a7dd3573ec9aac41b4a67f845 stealer

Malware Config

Extracted

Family

vidar

Botnet

f98c5b0a7dd3573ec9aac41b4a67f845

https://redddog.xyz
https://steamcommunity.com/profiles/76561199677575543
https://t.me/snsb82

Attributes

profile_id_v2
f98c5b0a7dd3573ec9aac41b4a67f845
user_agent
Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/8.0.500.0 Safari/534.6

Signatures

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/1504-23-0x0000000000900000-0x000000000104C000-memory.dmp	family_vidar_v7
behavioral2/memory/1504-32-0x0000000000900000-0x000000000104C000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/memory/1504-32-0x0000000000900000-0x000000000104C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/memory/1504-32-0x0000000000900000-0x000000000104C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
behavioral2/memory/1504-32-0x0000000000900000-0x000000000104C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral2/memory/1504-23-0x0000000000900000-0x000000000104C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/1504-32-0x0000000000900000-0x000000000104C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 916 set thread context of 5016	916	Setup.exe	86

Loads dropped DLL 1 IoCs

pid	Process
1504	BvInputDiag.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4588	1504	WerFault.exe	97

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
916	Setup.exe
916	Setup.exe
5016	netsh.exe
5016	netsh.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
916	Setup.exe
5016	netsh.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 5016	916	Setup.exe	86
PID 916 wrote to memory of 5016	916	Setup.exe	86
PID 916 wrote to memory of 5016	916	Setup.exe	86
PID 916 wrote to memory of 5016	916	Setup.exe	86
PID 5016 wrote to memory of 1504	5016	netsh.exe	97
PID 5016 wrote to memory of 1504	5016	netsh.exe	97
PID 5016 wrote to memory of 1504	5016	netsh.exe	97
PID 5016 wrote to memory of 1504	5016	netsh.exe	97
PID 5016 wrote to memory of 1504	5016	netsh.exe	97

C:\Users\Admin\AppData\Local\Temp\@#!!Newest_SoftWare_2024_P@SSCODE_%$\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\@#!!Newest_SoftWare_2024_P@SSCODE_%$\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\SysWOW64\netsh.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Users\Admin\AppData\Local\Temp\BvInputDiag.exe
    C:\Users\Admin\AppData\Local\Temp\BvInputDiag.exe
    3⤵
    - Loads dropped DLL
    PID:1504
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1892
      4⤵
      Program crash
      PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1504 -ip 1504
1⤵
PID:4340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

99b20255

Path C:\Users\Admin\AppData\Local\Temp\99b20255
Size 6.0MB
SHA256 46c19acbc2eb7dee528230071e73d892d420408128e073903a1931efbf5f6939
MD5 49811e88bfe0d39bb4f9625bbd072de7
SHA1 1e0510637750684f89148ced19b15d0de2fac2ec
SHA512 eb98ae7832dba7c2011e9db772c1b074e4c3df38cb7f03b878177d971453a003651e285dcb906fc787c13337e064141aa110d01a110e73ee1991b89c58216e65
SSDEEP 98304:c468+eUL/FhivA/2w1ScOV1kL0fJnZmOnjZnc7c5+aFIOORErJjylAQVqM:cdeUBhivAp1SbmGnlnjZnc77au+rSIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

BvInputDiag.exe

Path C:\Users\Admin\AppData\Local\Temp\BvInputDiag.exe
Size 136KB
SHA256 8e5e627881c8182bfbb64601c6f4f7b30ba950dfd10f638f404479406b2c03b8
MD5 3d754cfa4a5b2a3f19720550acf6d3cf
SHA1 e5c78edbd54e14a42258a6c223d2cf128530e1b6
SHA512 18db06443a718b8233ac9724e7f96310bf5841d2c980cd1d02e6fb6743e23acc13bd67fcd214b4c0650ac933f6f081759d699c73e14baf26ffc324c2b30f153b
SSDEEP 1536:G5stnXTXfKE+8gKuaFIe5BikUxaAahi7M8PD0RTr+jSxtOoh3xifOoh46xKl:06njPKE+8xvUx84cGEOomfOoOjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/916-8-0x0000000073FE0000-0x000000007415B000-memory.dmp

Download

memory/916-0-0x0000000073FE0000-0x000000007415B000-memory.dmp

Download

memory/916-9-0x0000000073FE0000-0x000000007415B000-memory.dmp

Download

memory/916-7-0x0000000073FF2000-0x0000000073FF4000-memory.dmp

Download

memory/916-1-0x00007FFFBD190000-0x00007FFFBD385000-memory.dmp

Download

memory/1504-23-0x0000000000900000-0x000000000104C000-memory.dmp

Download

memory/1504-25-0x00007FFFBD190000-0x00007FFFBD385000-memory.dmp

Download

memory/1504-32-0x0000000000900000-0x000000000104C000-memory.dmp

Download

memory/5016-11-0x0000000073FE1000-0x0000000073FEF000-memory.dmp

Download

memory/5016-13-0x00007FFFBD190000-0x00007FFFBD385000-memory.dmp

Download

memory/5016-16-0x0000000073FEE000-0x0000000073FF0000-memory.dmp

Download

memory/5016-17-0x0000000073FE1000-0x0000000073FEF000-memory.dmp

Download

memory/5016-20-0x0000000073FE1000-0x0000000073FEF000-memory.dmp

Download