vidar | 291f381da3286ea93c38bb325e19f35744349c3543708135d8be731f4bafb6e2

max time kernel
205s
max time network
222s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/02/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요.exe
Size 545KB
Sample260207-tcbexaes9d
SHA256 291f381da3286ea93c38bb325e19f35744349c3543708135d8be731f4bafb6e2
MD5 54bef758433c98353b61bf1e2aecefb2
SHA1 06feb43c6d58eab893396f63aa2e1d0e4542f7d1
SHA512 3bfb51f9bee7033ebde0f418b88327b7c7a322b3e0572d92ad4cdf37c9fbed22d518c9ce2d8d5638381542bef83077d8054184b9f613b815df6906a99fd4526f
SSDEEP 12288:fPT9h+l+ofoa/sHoNFU9Zd1jWOYE9QjmJl/2hgDMjhP:fPT9hifJKZd1jWOY2emPOuDMd
TLSH
T138C4F102F390D961DD7B49308B7ADEF0162FB8B14E74665623A46A1F2EB01D1993B31F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery vidar stealer

Malware Config

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral14/memory/3300-2-0x0000000002590000-0x0000000002619000-memory.dmp	family_vidar

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2084	3300	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요.exe

C:\Users\Admin\AppData\Local\Temp\전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요.exe
"C:\Users\Admin\AppData\Local\Temp\전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 292
  2⤵
  - Program crash
  PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3300 -ip 3300
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3300-1-0x00000000009D0000-0x0000000000AD0000-memory.dmp

Download

memory/3300-2-0x0000000002590000-0x0000000002619000-memory.dmp