vidar | a6b304da706f65520019273d5f35dc9ede582febfe9e9a1d87c482eb46433256

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2025, 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe
Size

5.3MB
MD5

168804a10535acfc01021a74b8d07716
SHA1

67818df0d6b734dafd885eb717041e37da8a9d0c
SHA256

0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03
SHA512

1bdc3016c9caaf5afacdf2537a82c710bce75fc5c088e7f5ace76fcace355043ec4493762222bf68f28259285d46ccbed249abbc0a2fe62f2330a6149a93f482
SSDEEP

49152:a05yrkuG6WwwctHu1s/gAufgfHyZOZtIvAsIticBd2wOHYyTjEcW9CyPVhL9zffj:aSzuGgR+s/gXYfy+sI3cSJHz0q6

Score

10^/10

vidar e32c7e36b331d3417c4efa7bbd76e7bb discovery stealer

Malware Config

Extracted

Family

vidar

Version

12.5

Botnet

e32c7e36b331d3417c4efa7bbd76e7bb

https://t.me/w0ctzn

https://steamcommunity.com/profiles/76561199817305251

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3924 set thread context of 1932	3924	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	104

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 1932	3924	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	104
PID 3924 wrote to memory of 1932	3924	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	104
PID 3924 wrote to memory of 1932	3924	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	104
PID 3924 wrote to memory of 1932	3924	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	104
PID 3924 wrote to memory of 1932	3924	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	104
PID 3924 wrote to memory of 1932	3924	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	104
PID 3924 wrote to memory of 1932	3924	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	104
PID 3924 wrote to memory of 1932	3924	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	104
PID 3924 wrote to memory of 1932	3924	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	104
PID 3924 wrote to memory of 1932	3924	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	104
PID 3924 wrote to memory of 1932	3924	0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe	104

C:\Users\Admin\AppData\Local\Temp\0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe
"C:\Users\Admin\AppData\Local\Temp\0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IBI1KJ4T\76561199817305251[1].htm

Filesize
34KB

MD5
160e8ba08c367e1ac3099d59a4a2280c

SHA1
a0ea2ffb6a0664fa36ad2e4eb245199b7b4897d1

SHA256
cee17f87e3cb48c0acaa7d3ce37d3742f3968fb730feef14245663a8952fb929

SHA512
2885977a846470b16cf43110abf3488d87369ee010041b8bb51afe295aca00f9678bc623221f1672257924f15a12d597b2eff5dfc57d65520adafbfc4dd49111

Download Submit
memory/1932-0-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1932-1-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1932-2-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1932-4-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download