vidar | 85dee32ceb240f5e255ea6c0aaa516965ebee42072d52373156e1b605d80b7cb

Analysis

max time kernel
128s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_85dee32ceb240f5e255ea6c0aaa516965ebee42072d52373156e1b605d80b7cb.exe
Size

761.7MB
MD5

f0debc46a47f40bbffbf8d563973a0f5
SHA1

62182857b58cddee7903f66710ed0d7827e0d35d
SHA256

85dee32ceb240f5e255ea6c0aaa516965ebee42072d52373156e1b605d80b7cb
SHA512

7587e0313edcadd91c1c75d2737fa31cee2498dc85a371d291af8d11f883808acab4bcf96d6062eae15f1f75eb346ca5cfed4cf1dfbbcb89d5cb10ee0392c8f9
SSDEEP

12288:rzVtFFIkfyPV9VRrjCR5TJmkuSiD63cZ23:vbIkg9HUz/iD6sZI

Score

10^/10

vidar 1375 discovery stealer

Malware Config

Extracted

Family

vidar

Version

55.7

Botnet

1375

https://t.me/deadftx

https://www.tiktok.com/@user6068972597711

http://116.202.2.1:80

Attributes

profile_id
1375

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2988 set thread context of 4372	2988	JaffaCakes118_85dee32ceb240f5e255ea6c0aaa516965ebee42072d52373156e1b605d80b7cb.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4616	2988	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_85dee32ceb240f5e255ea6c0aaa516965ebee42072d52373156e1b605d80b7cb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 4372	2988	JaffaCakes118_85dee32ceb240f5e255ea6c0aaa516965ebee42072d52373156e1b605d80b7cb.exe	83
PID 2988 wrote to memory of 4372	2988	JaffaCakes118_85dee32ceb240f5e255ea6c0aaa516965ebee42072d52373156e1b605d80b7cb.exe	83
PID 2988 wrote to memory of 4372	2988	JaffaCakes118_85dee32ceb240f5e255ea6c0aaa516965ebee42072d52373156e1b605d80b7cb.exe	83
PID 2988 wrote to memory of 4372	2988	JaffaCakes118_85dee32ceb240f5e255ea6c0aaa516965ebee42072d52373156e1b605d80b7cb.exe	83
PID 2988 wrote to memory of 4372	2988	JaffaCakes118_85dee32ceb240f5e255ea6c0aaa516965ebee42072d52373156e1b605d80b7cb.exe	83

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85dee32ceb240f5e255ea6c0aaa516965ebee42072d52373156e1b605d80b7cb.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85dee32ceb240f5e255ea6c0aaa516965ebee42072d52373156e1b605d80b7cb.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 500
  2⤵
  - Program crash
  PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2988 -ip 2988
1⤵
PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-0-0x0000000000427000-0x0000000000428000-memory.dmp

Filesize
4KB

Download
memory/4372-1-0x00000000013B0000-0x000000000140F000-memory.dmp

Filesize
380KB

Download
memory/4372-7-0x00000000013B0000-0x000000000140F000-memory.dmp

Filesize
380KB

Download