vidar | a6b304da706f65520019273d5f35dc9ede582febfe9e9a1d87c482eb46433256

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2025, 08:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe
Size

5.3MB
MD5

168804a10535acfc01021a74b8d07716
SHA1

67818df0d6b734dafd885eb717041e37da8a9d0c
SHA256

0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03
SHA512

1bdc3016c9caaf5afacdf2537a82c710bce75fc5c088e7f5ace76fcace355043ec4493762222bf68f28259285d46ccbed249abbc0a2fe62f2330a6149a93f482
SSDEEP

49152:a05yrkuG6WwwctHu1s/gAufgfHyZOZtIvAsIticBd2wOHYyTjEcW9CyPVhL9zffj:aSzuGgR+s/gXYfy+sI3cSJHz0q6

Score

10^/10

vidar e32c7e36b331d3417c4efa7bbd76e7bb discovery stealer

Malware Config

Extracted

Family

vidar

Version

12.5

Botnet

e32c7e36b331d3417c4efa7bbd76e7bb

https://t.me/w0ctzn

https://steamcommunity.com/profiles/76561199817305251

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1876 set thread context of 5044	1876	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	97

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 5044	1876	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	97
PID 1876 wrote to memory of 5044	1876	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	97
PID 1876 wrote to memory of 5044	1876	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	97
PID 1876 wrote to memory of 5044	1876	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	97
PID 1876 wrote to memory of 5044	1876	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	97
PID 1876 wrote to memory of 5044	1876	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	97
PID 1876 wrote to memory of 5044	1876	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	97
PID 1876 wrote to memory of 5044	1876	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	97
PID 1876 wrote to memory of 5044	1876	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	97
PID 1876 wrote to memory of 5044	1876	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	97
PID 1876 wrote to memory of 5044	1876	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	97

C:\Users\Admin\AppData\Local\Temp\0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe
"C:\Users\Admin\AppData\Local\Temp\0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\463FIIFI\76561199817305251[1].htm

Filesize
34KB

MD5
f5a53c2277c0a7f674bcf5af9f172c8f

SHA1
5402b0084ffd8fff82f8f2d98ba1c4f325e47797

SHA256
4f5df41d96b6562fe4a6500364bed7eeb30fb67d2402029ec83fa9cb93dfb0c4

SHA512
231f2392446f28c8e3dd51ed88a84b38c8020aa11414fca42c6e14d21f5d7ce60b50a4351b22a8444c84d85e488cca57c1822b573ae2b1b48b91d891cfc4ee59

Download Submit
memory/5044-0-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/5044-1-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/5044-2-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/5044-4-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download