Overview

overview

10

Static

static

3

291f381da3...e2.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    80s
  • max time network
    65s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04-02-2025 13:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    291f381da3286ea93c38bb325e19f35744349c3543708135d8be731f4bafb6e2.exe

  • Size

    545KB

  • MD5

    54bef758433c98353b61bf1e2aecefb2

  • SHA1

    06feb43c6d58eab893396f63aa2e1d0e4542f7d1

  • SHA256

    291f381da3286ea93c38bb325e19f35744349c3543708135d8be731f4bafb6e2

  • SHA512

    3bfb51f9bee7033ebde0f418b88327b7c7a322b3e0572d92ad4cdf37c9fbed22d518c9ce2d8d5638381542bef83077d8054184b9f613b815df6906a99fd4526f

  • SSDEEP

    12288:fPT9h+l+ofoa/sHoNFU9Zd1jWOYE9QjmJl/2hgDMjhP:fPT9hifJKZd1jWOY2emPOuDMd

Score
10/10
vidardiscoverystealer

Malware Config

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Vidar Stealer 1 IoCs
    stealer
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 37 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\291f381da3286ea93c38bb325e19f35744349c3543708135d8be731f4bafb6e2.exe
    "C:\Users\Admin\AppData\Local\Temp\291f381da3286ea93c38bb325e19f35744349c3543708135d8be731f4bafb6e2.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2460
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 196
      2⤵
      • Program crash
      PID:3328
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2460 -ip 2460
    1⤵
      PID:3840
    • C:\Windows\system32\control.exe
      "C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:1068
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
      • System Location Discovery: System Language Discovery
      PID:1000
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /7
        2⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2780
    • C:\Windows\system32\BackgroundTransferHost.exe
      "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
      1⤵
      • Modifies registry class
      PID:1144
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:5000
      • C:\Users\Admin\AppData\Local\Temp\291f381da3286ea93c38bb325e19f35744349c3543708135d8be731f4bafb6e2.exe
        "C:\Users\Admin\AppData\Local\Temp\291f381da3286ea93c38bb325e19f35744349c3543708135d8be731f4bafb6e2.exe"
        1⤵
        • System Location Discovery: System Language Discovery
        PID:224
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 300
          2⤵
          • Program crash
          PID:628
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 224 -ip 224
        1⤵
          PID:3400

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
          Filesize

          28KB

          MD5

          e939d2646cb8a48050f1c4ffdc892599

          SHA1

          2a3d6dc435e256ecba1d3ae95158545b6b8d2810

          SHA256

          ad81cec08102128b2fdcc66d79cf256bdf584c1f7714e2259aa1ba9b6de6b3fe

          SHA512

          81ccffee37038a52754cb704b663e710d0a31077a0d070c20c1dff4c6f08ac149f1e6567c97a7496d032bb7a11d926fb15a39482349545718e9c6022db2a9f8e

          Download Submit

        • memory/2460-1-0x0000000000B10000-0x0000000000C10000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2460-2-0x00000000025B0000-0x0000000002639000-memory.dmp

          Filesize

          548KB

          Download

        • memory/2780-10-0x000002611F920000-0x000002611F921000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2780-6-0x000002611F920000-0x000002611F921000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2780-5-0x000002611F920000-0x000002611F921000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2780-4-0x000002611F920000-0x000002611F921000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2780-11-0x000002611F920000-0x000002611F921000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2780-16-0x000002611F920000-0x000002611F921000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2780-15-0x000002611F920000-0x000002611F921000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2780-14-0x000002611F920000-0x000002611F921000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2780-13-0x000002611F920000-0x000002611F921000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2780-12-0x000002611F920000-0x000002611F921000-memory.dmp

          Filesize

          4KB

          Download