vidar | 8f95ae5e5e774a322e272b430e09bbe7790ab8c57a804e07a053d489f48c8979

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe
Size 1.5MB
Sample240908-ryjbjatdmc
SHA256 8f95ae5e5e774a322e272b430e09bbe7790ab8c57a804e07a053d489f48c8979
MD5 d494477460b26ffbbd75a1e62b0f243e
SHA1 484e46737ae1919047a32126a5423ec1f563bc5f
SHA512 bca9b9235cf0796352f6f8847d176b613e1421367af677281df306bdab19f241a9bfe77749e3dc5178008767b8cb5cb4a8ed8702119b1d5e616605e293691d3c
SSDEEP 24576:/obJrTrxaXKm0DDkXOSFcZekxcLxYCNc+mOw+RvVXk6ZsId:gtrTsXXQDkXOSFcZe1KR+vXE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar 921 agilenet discovery stealer

Malware Config

Extracted

Family

vidar

Version

41.1

Botnet

https://mas.to/@bardak1ho

Attributes

profile_id
921

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral1/memory/2884-21-0x0000000000400000-0x00000000004D7000-memory.dmp	family_vidar
behavioral1/memory/2884-19-0x0000000000400000-0x00000000004D7000-memory.dmp	family_vidar
behavioral1/memory/2884-15-0x0000000000400000-0x00000000004D7000-memory.dmp	family_vidar

Loads dropped DLL 1 IoCs

pid	Process
2540	d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/2540-1-0x0000000001240000-0x00000000013D2000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2540 set thread context of 2884	2540	d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2256	2884	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2884	2540	d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe	30
PID 2540 wrote to memory of 2884	2540	d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe	30
PID 2540 wrote to memory of 2884	2540	d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe	30
PID 2540 wrote to memory of 2884	2540	d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe	30
PID 2540 wrote to memory of 2884	2540	d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe	30
PID 2540 wrote to memory of 2884	2540	d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe	30
PID 2540 wrote to memory of 2884	2540	d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe	30
PID 2540 wrote to memory of 2884	2540	d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe	30
PID 2540 wrote to memory of 2884	2540	d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe	30
PID 2884 wrote to memory of 2256	2884	d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe	31
PID 2884 wrote to memory of 2256	2884	d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe	31
PID 2884 wrote to memory of 2256	2884	d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe	31
PID 2884 wrote to memory of 2256	2884	d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Users\Admin\AppData\Local\Temp\d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d494477460b26ffbbd75a1e62b0f243e_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 160
    3⤵
    - Program crash
    PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AgileDotNetRT.dll

Path C:\Users\Admin\AppData\Local\Temp\9fcb5626-ecc1-422b-9975-65e4c1e36203\AgileDotNetRT.dll
Size 140KB
SHA256 55ff1e0a4e5866d565ceeb9baafac73fdcb4464160fc6c78104d935009935cd7
MD5 edd74be9723cdc6a5692954f0e51c9f3
SHA1 e9fb66ceee1ba4ce7e5b8271b3e1ed7cb9acf686
SHA512 80abecdd07f364283f216d8f4d90a4da3efd4561900631fce05c2916afeb1b5bbce23ae92d57430b7b2b06c172b2ad701b2ab75b6dfd2a861abcf7edc38462f3
SSDEEP 3072:bKc01bfnhNNdyrGyV9UbiphygthKL9BhTrws80a7W:bKc01bfnBeUbiphygHKL/hnxG7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2540-23-0x00000000745C0000-0x00000000745E8000-memory.dmp

Download

memory/2540-1-0x0000000001240000-0x00000000013D2000-memory.dmp

Download

memory/2540-5-0x0000000074940000-0x000000007502E000-memory.dmp

Download

memory/2540-9-0x00000000745C0000-0x00000000745E8000-memory.dmp

Download

memory/2540-10-0x00000000747C0000-0x0000000074840000-memory.dmp

Download

memory/2540-11-0x00000000009F0000-0x0000000000A0C000-memory.dmp

Download

memory/2540-22-0x0000000074940000-0x000000007502E000-memory.dmp

Download

memory/2540-0-0x000000007494E000-0x000000007494F000-memory.dmp

Download

memory/2884-13-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

memory/2884-19-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

memory/2884-21-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

memory/2884-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2884-15-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

memory/2884-14-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

memory/2884-12-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads