vidar | ed422c419c32f42e75d854a9d44781f24fa771822b0298ecac499e6863920a6c

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_ed422c419c32f42e75d854a9d44781f24fa771822b0298ecac499e6863920a6c.exe
Size

815.4MB
MD5

757a441a4eaad964c783c5b072586b38
SHA1

8abade2a0b0453ce8291852082e62f40b04f5b0a
SHA256

ed422c419c32f42e75d854a9d44781f24fa771822b0298ecac499e6863920a6c
SHA512

6703f43c5d42ab8f9f89c474061cc685153c3c6428fc019a20d9faaf9e31ab41962117a831932266db9f5584e7bbd9da72d856849095837a95b4c395f3d9a81e
SSDEEP

49152:fERHnw1qeeHvLk4E7jrl1mZ47aIotnsPSNNISLfZNlYlV3KGpYHxx/Msj:fE1/HvypotNLfZNlKVs3/Msj

Score

10^/10

vidar stealer

Malware Config

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

.NET Reactor proctector 35 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/3028-1-0x0000000000B90000-0x000000000138E000-memory.dmp	net_reactor
behavioral2/memory/3028-2-0x0000000003570000-0x00000000035FE000-memory.dmp	net_reactor
behavioral2/memory/3028-51-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-67-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-65-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-63-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-61-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-59-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-57-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-55-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-53-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-49-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-47-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-45-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-43-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-42-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-39-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-37-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-35-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-33-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-29-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-27-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-25-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-23-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-21-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-19-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-17-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-15-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-13-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-11-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-7-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-5-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-4-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-31-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor
behavioral2/memory/3028-9-0x0000000003570000-0x00000000035F8000-memory.dmp	net_reactor

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3028	JaffaCakes118_ed422c419c32f42e75d854a9d44781f24fa771822b0298ecac499e6863920a6c.exe
3028	JaffaCakes118_ed422c419c32f42e75d854a9d44781f24fa771822b0298ecac499e6863920a6c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	JaffaCakes118_ed422c419c32f42e75d854a9d44781f24fa771822b0298ecac499e6863920a6c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1548	3028	JaffaCakes118_ed422c419c32f42e75d854a9d44781f24fa771822b0298ecac499e6863920a6c.exe	84
PID 3028 wrote to memory of 1548	3028	JaffaCakes118_ed422c419c32f42e75d854a9d44781f24fa771822b0298ecac499e6863920a6c.exe	84
PID 3028 wrote to memory of 1548	3028	JaffaCakes118_ed422c419c32f42e75d854a9d44781f24fa771822b0298ecac499e6863920a6c.exe	84

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ed422c419c32f42e75d854a9d44781f24fa771822b0298ecac499e6863920a6c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ed422c419c32f42e75d854a9d44781f24fa771822b0298ecac499e6863920a6c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:1548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3028-0-0x00007FFE63B23000-0x00007FFE63B25000-memory.dmp

Filesize
8KB

Download
memory/3028-1-0x0000000000B90000-0x000000000138E000-memory.dmp

Filesize
8.0MB

Download
memory/3028-2-0x0000000003570000-0x00000000035FE000-memory.dmp

Filesize
568KB

Download
memory/3028-3-0x00007FFE63B20000-0x00007FFE645E1000-memory.dmp

Filesize
10.8MB

Download
memory/3028-51-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-67-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-65-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-63-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-61-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-59-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-57-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-55-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-53-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-49-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-47-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-45-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-43-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-42-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-39-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-37-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-35-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-33-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-29-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-27-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-25-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-23-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-21-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-19-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-17-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-15-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-13-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-11-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-7-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-5-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-4-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-31-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-9-0x0000000003570000-0x00000000035F8000-memory.dmp

Filesize
544KB

Download
memory/3028-1468-0x00007FFE63B20000-0x00007FFE645E1000-memory.dmp

Filesize
10.8MB

Download
memory/3028-1470-0x00007FFE63B20000-0x00007FFE645E1000-memory.dmp

Filesize
10.8MB

Download