vidar | 05e92880112a00292ed31f8cd3f0679f7c0295952f3743af2285eedfdf5155d0

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
05e92880112a00292ed31f8cd3f0679f7c0295952f3743af2285eedfdf5155d0.exe
Size 9.2MB
Sample260528-eahc4sgw2w
SHA256 05e92880112a00292ed31f8cd3f0679f7c0295952f3743af2285eedfdf5155d0
MD5 1138fd03ff26e2891e6db821ddb0e02d
SHA1 ddbc017257a874acff7f911b9478cd0377ed56f8
SHA512 8c43f25c3b4411c9e3a1951ec0d456ad24231e6cc54b55c3cb48ee282cedb830408f4b7c0b76834cde793e197118f346326e1b63fdf16dec82213b72aa8a3ed2
SSDEEP 49152:Aa6jgnfQVCpf+DYEuUmK1N0TqUacS1+UySCFLgpoQB5sIR6l3x96WoeopFN4Xg66:ASwUK/xaHoeojNEZPjq3X1O/aUPgr
TLSH
T1CEA6062BEE648268CD59913BD0A38F47A9F370B50F3ACDEB214307996B859C05D3E725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

f10128ab5391ea850a8ccc4275613489 collection discovery vidar stealer

Malware Config

Extracted

Family

vidar

Version

18.3

Botnet

f10128ab5391ea850a8ccc4275613489

https://135.181.117.114
https://telegram.me/m0r5hl
https://steamcommunity.com/profiles/76561198733506974

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/904-7-0x0000000140000000-0x00000001400F2000-memory.dmp	family_vidar_v15
behavioral2/memory/904-35-0x0000000140000000-0x00000001400F2000-memory.dmp	family_vidar_v15

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	05e92880112a00292ed31f8cd3f0679f7c0295952f3743af2285eedfdf5155d0.exe
Key opened	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	05e92880112a00292ed31f8cd3f0679f7c0295952f3743af2285eedfdf5155d0.exe
Key opened	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	05e92880112a00292ed31f8cd3f0679f7c0295952f3743af2285eedfdf5155d0.exe
Key opened	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	05e92880112a00292ed31f8cd3f0679f7c0295952f3743af2285eedfdf5155d0.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	05e92880112a00292ed31f8cd3f0679f7c0295952f3743af2285eedfdf5155d0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	05e92880112a00292ed31f8cd3f0679f7c0295952f3743af2285eedfdf5155d0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
904	05e92880112a00292ed31f8cd3f0679f7c0295952f3743af2285eedfdf5155d0.exe
904	05e92880112a00292ed31f8cd3f0679f7c0295952f3743af2285eedfdf5155d0.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	05e92880112a00292ed31f8cd3f0679f7c0295952f3743af2285eedfdf5155d0.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	05e92880112a00292ed31f8cd3f0679f7c0295952f3743af2285eedfdf5155d0.exe

C:\Users\Admin\AppData\Local\Temp\05e92880112a00292ed31f8cd3f0679f7c0295952f3743af2285eedfdf5155d0.exe
"C:\Users\Admin\AppData\Local\Temp\05e92880112a00292ed31f8cd3f0679f7c0295952f3743af2285eedfdf5155d0.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-0-0x00000000029C0000-0x00000000029C1000-memory.dmp

Download

memory/904-2-0x0000000140000000-0x00000001400F2000-memory.dmp

Download

memory/904-6-0x0000000004DA0000-0x00000000050E7000-memory.dmp

Download

memory/904-7-0x0000000140000000-0x00000001400F2000-memory.dmp

Download

memory/904-28-0x0000000004DA0000-0x00000000050E7000-memory.dmp

Download

memory/904-27-0x0000000000400000-0x0000000000D45000-memory.dmp

Download

memory/904-35-0x0000000140000000-0x00000001400F2000-memory.dmp

Download