vidar | 53a1711803a4b6acdcbe980b0a7970f52b9b82591688e272968eaff944a6fc30

Analysis

max time kernel
92s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2024 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2168-0-0x0000000000400000-0x0000000000676000-memory.exe
Size

2.5MB
MD5

b637df21fcb8204fe2eed32cfb263eb0
SHA1

206bf3e7fff449121d71e6c4dfb51f36f04416b7
SHA256

53a1711803a4b6acdcbe980b0a7970f52b9b82591688e272968eaff944a6fc30
SHA512

f135d2a8a7e6bb21f6bad5e5410d9174945affe62bd7f8496a6acedb1f319e5a29c7c9784e889ec84e4af229cfdee0466a72df533be625363753d49821a088b4
SSDEEP

3072:XulT2PUeGyKpKJmdhzMJGydGcB00NVlbPaNEQytXq0oUlp8Hra9sTTa57jdaVIx+:elqPvKpKJNJGyRl6If8aSTa57jdaVI

Score

10^/10

vidar 744fd163d6d4e0ac37e4032bcbfbb6af discovery stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

744fd163d6d4e0ac37e4032bcbfbb6af

Signatures

Detect Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/2864-0-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5076	2864	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2168-0-0x0000000000400000-0x0000000000676000-memory.exe

C:\Users\Admin\AppData\Local\Temp\2168-0-0x0000000000400000-0x0000000000676000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2168-0-0x0000000000400000-0x0000000000676000-memory.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 216
  2⤵
  - Program crash
  PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2864 -ip 2864
1⤵
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2864-0-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download