vidar | 82839b7a610f7923f282f88f241b79c66332e0d043b41f2574c776484da7957a

General

Target

82839b7a610f7923f282f88f241b79c66332e0d043b41f2574c776484da7957aN.exe
Size

1.4MB
MD5

35bb5be7a9f9ca29e7239cc3f713b2d0
SHA1

a8da6cb42cb3a8dfc5e0d2d0fc9de16f94d10932
SHA256

82839b7a610f7923f282f88f241b79c66332e0d043b41f2574c776484da7957a
SHA512

4c6e3d70a9b58ee5e08588eee5ef5a40d8676028d8d68fe293cb7b0b6764061f0ec5170d1d058ba90a86d09f0e33c31987c96cbd815d46441139c19896b49775
SSDEEP

24576:AF3iok5nCcAT5Aw/pkPpbUAEQQi+HrFZ390w28KSaVBXecD4fvPVlFegzHLYwFvx:AFSouMByUswrXKFSxBI0W

Score

10^/10

vidar 869 discovery stealer

Malware Config

Extracted

Family

vidar

Version

48.4

Botnet

869

C2

https://koyu.space/@qmashton

Attributes

profile_id
869

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral2/memory/3764-3-0x0000000002B70000-0x0000000002C47000-memory.dmp	family_vidar
behavioral2/memory/3764-4-0x0000000000400000-0x00000000004D8000-memory.dmp	family_vidar
behavioral2/memory/3764-8-0x0000000000400000-0x0000000000578000-memory.dmp	family_vidar
behavioral2/memory/3764-10-0x0000000000400000-0x00000000004D8000-memory.dmp	family_vidar

Program crash 13 IoCs

pid	pid_target	Process	procid_target
3396	3764	WerFault.exe	82
1700	3764	WerFault.exe	82
5060	3764	WerFault.exe	82
316	3764	WerFault.exe	82
1924	3764	WerFault.exe	82
2452	3764	WerFault.exe	82
1728	3764	WerFault.exe	82
4796	3764	WerFault.exe	82
3920	3764	WerFault.exe	82
1904	3764	WerFault.exe	82
760	3764	WerFault.exe	82
4312	3764	WerFault.exe	82
4412	3764	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82839b7a610f7923f282f88f241b79c66332e0d043b41f2574c776484da7957aN.exe

C:\Users\Admin\AppData\Local\Temp\82839b7a610f7923f282f88f241b79c66332e0d043b41f2574c776484da7957aN.exe
"C:\Users\Admin\AppData\Local\Temp\82839b7a610f7923f282f88f241b79c66332e0d043b41f2574c776484da7957aN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 776
  2⤵
  - Program crash
  PID:3396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 816
  2⤵
  - Program crash
  PID:1700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 896
  2⤵
  - Program crash
  PID:5060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 936
  2⤵
  - Program crash
  PID:316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 944
  2⤵
  - Program crash
  PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 964
  2⤵
  - Program crash
  PID:2452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 1140
  2⤵
  - Program crash
  PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 1484
  2⤵
  - Program crash
  PID:4796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 1576
  2⤵
  - Program crash
  PID:3920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 1832
  2⤵
  - Program crash
  PID:1904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 1664
  2⤵
  - Program crash
  PID:760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 1636
  2⤵
  - Program crash
  PID:4312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 1632
  2⤵
  - Program crash
  PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3764 -ip 3764
1⤵
PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3764 -ip 3764
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3764 -ip 3764
1⤵
PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3764 -ip 3764
1⤵
PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3764 -ip 3764
1⤵
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3764 -ip 3764
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3764 -ip 3764
1⤵
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3764 -ip 3764
1⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3764 -ip 3764
1⤵
PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3764 -ip 3764
1⤵
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 3764 -ip 3764
1⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3764 -ip 3764
1⤵
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3764 -ip 3764
1⤵
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3764-0-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/3764-1-0x0000000000400000-0x0000000000578000-memory.dmp

Filesize
1.5MB

Download
memory/3764-2-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/3764-3-0x0000000002B70000-0x0000000002C47000-memory.dmp

Filesize
860KB

Download
memory/3764-4-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3764-8-0x0000000000400000-0x0000000000578000-memory.dmp

Filesize
1.5MB

Download
memory/3764-10-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download

Analysis

Sharing