Analysis

  • max time kernel
    127s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2024 11:15

General

  • Target

    JaffaCakes118_eb44bfea15585a4d23b8bcb84c9ba166bf2c0d301dc1d2a1edc597892381738a.exe

  • Size

    778.6MB

  • MD5

    09c6875214def62b316d9d8f40f25742

  • SHA1

    24a317685809eec394720b33090e05a83b0976eb

  • SHA256

    eb44bfea15585a4d23b8bcb84c9ba166bf2c0d301dc1d2a1edc597892381738a

  • SHA512

    7bcca9b57ad0590b766882aa1410899159b09b3ea6d8ff63ce87890db3dc533d4e2b09cad0bb58c46614ef1211b040e1c9bfd92cb44bb69a4d13ceca30269a62

  • SSDEEP

    25165824:1nnnnnnnnnnnnnnnnnnnnnnnnmnnnnnnnnnnnnnnnnnnnnnn:1nnnnnnnnnnnnnnnnnnnnnnnnmnnnnnn

Malware Config

Extracted

Family

vidar

Version

4.8

Botnet

27d0417c9847ebd9235b928714df3b9c

C2

https://t.me/vookihhfd

https://t.me/booliiksws

https://t.me/sundayevent

https://steamcommunity.com/profiles/76561198982268531

Attributes
  • profile_id_v2

    27d0417c9847ebd9235b928714df3b9c

  • user_agent

    Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar family
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_eb44bfea15585a4d23b8bcb84c9ba166bf2c0d301dc1d2a1edc597892381738a.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_eb44bfea15585a4d23b8bcb84c9ba166bf2c0d301dc1d2a1edc597892381738a.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/380-0-0x0000000000E93000-0x0000000001169000-memory.dmp

    Filesize

    2.8MB

  • memory/380-6-0x0000000001C40000-0x0000000001C41000-memory.dmp

    Filesize

    4KB

  • memory/380-5-0x0000000001C30000-0x0000000001C31000-memory.dmp

    Filesize

    4KB

  • memory/380-4-0x0000000001C20000-0x0000000001C21000-memory.dmp

    Filesize

    4KB

  • memory/380-3-0x00000000019F0000-0x00000000019F1000-memory.dmp

    Filesize

    4KB

  • memory/380-2-0x00000000019E0000-0x00000000019E1000-memory.dmp

    Filesize

    4KB

  • memory/380-1-0x00000000019D0000-0x00000000019D1000-memory.dmp

    Filesize

    4KB

  • memory/380-9-0x0000000000B60000-0x0000000001924000-memory.dmp

    Filesize

    13.8MB

  • memory/380-23-0x0000000000E93000-0x0000000001169000-memory.dmp

    Filesize

    2.8MB

  • memory/380-24-0x0000000000B60000-0x0000000001924000-memory.dmp

    Filesize

    13.8MB