vidar | cfdd3649ea2e7052892018d127f09dfd6e7c9a7934652842dc609ab2f24c5e54

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2024 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2820-12-0x0000000000400000-0x0000000000676000-memory.exe
Size

2.5MB
MD5

664dc9f890ca71ec4461e280100db049
SHA1

d90edffdc0a528746d5268c8985b537be4eafd1d
SHA256

cfdd3649ea2e7052892018d127f09dfd6e7c9a7934652842dc609ab2f24c5e54
SHA512

77dc883077523a36f53692b8417e6346fe1607066969832ddbc3421f31b38b3d974ff3ad4622e228c3e5f67093f1b022876b76b4b7f5ff702eb787b5f552f39c
SSDEEP

6144:nlqPvKpKJNJGyRly38aSp0ZH8FNBa31154:nmRJNMalysaO0t8bS11

Score

10^/10

vidar 6c8ce6f422a1d9cf34f23d1c2168e754 discovery stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

6c8ce6f422a1d9cf34f23d1c2168e754

Signatures

Detect Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/3944-0-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4344	3944	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2820-12-0x0000000000400000-0x0000000000676000-memory.exe

C:\Users\Admin\AppData\Local\Temp\2820-12-0x0000000000400000-0x0000000000676000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2820-12-0x0000000000400000-0x0000000000676000-memory.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 216
  2⤵
  - Program crash
  PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3944 -ip 3944
1⤵
PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3944-0-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download