vidar | b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681.exe
Size

761.7MB
MD5

b92a4ca915f87e947fc78cc944e6f8a7
SHA1

d87405c2e56e3a9e83b96ff6bf69e45119e370cc
SHA256

b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681
SHA512

6ca788aa60848ed4743aa91033e07f3a999ebc85dffc47f45efe7cd4a43346cbde309fbf9e76bfe43edf784cc1e6f345567c6d5e18926bef0533799b566f3f37
SSDEEP

12288:Sy1R5p0OrYM+FiLts6hjiYkJTNIGLV69jJE:Sy1RZYsRs+j8J5f84

Score

10^/10

vidar 1375 discovery stealer

Malware Config

Extracted

Family

vidar

Version

55.6

Botnet

1375

https://t.me/alertbabka7743

http://5.252.177.45:80

Attributes

profile_id
1375

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1620 set thread context of 96096	1620	JaffaCakes118_b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681.exe	32

Program crash 1 IoCs

pid	pid_target	Process	procid_target
96140	1620	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 96096	1620	JaffaCakes118_b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681.exe	32
PID 1620 wrote to memory of 96096	1620	JaffaCakes118_b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681.exe	32
PID 1620 wrote to memory of 96096	1620	JaffaCakes118_b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681.exe	32
PID 1620 wrote to memory of 96096	1620	JaffaCakes118_b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681.exe	32
PID 1620 wrote to memory of 96096	1620	JaffaCakes118_b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681.exe	32
PID 1620 wrote to memory of 96096	1620	JaffaCakes118_b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681.exe	32
PID 1620 wrote to memory of 96096	1620	JaffaCakes118_b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681.exe	32
PID 1620 wrote to memory of 96096	1620	JaffaCakes118_b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681.exe	32
PID 1620 wrote to memory of 96096	1620	JaffaCakes118_b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681.exe	32
PID 1620 wrote to memory of 96140	1620	JaffaCakes118_b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681.exe	33
PID 1620 wrote to memory of 96140	1620	JaffaCakes118_b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681.exe	33
PID 1620 wrote to memory of 96140	1620	JaffaCakes118_b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681.exe	33
PID 1620 wrote to memory of 96140	1620	JaffaCakes118_b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b39871b0d3b4b1bbf994fcc3cece1fa215a7ab98e1d1617b76de3f2c8e611681.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:96096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 94592
  2⤵
  - Program crash
  PID:96140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-0-0x0000000000DC2000-0x0000000000DC3000-memory.dmp

Filesize
4KB

Download
memory/96096-10-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/96096-1-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/96096-8-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/96096-3-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/96096-11-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download