Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
11/08/2026, 21:31
General
- Target d2e8fb0276b020ba2236162be04d11cb19e5d4327cb333d34f6af7c00ac534b3.bin.dll
- Size 3.6MB
- Sample260811-1de8tasdkf
- SHA256 d2e8fb0276b020ba2236162be04d11cb19e5d4327cb333d34f6af7c00ac534b3
Malware Config
Extracted
-
vidar
-
2.3
-
b9b062d82bce1a3c325735ef7c58b863
-
https://167.233.197.223
-
https://telegram.me/af97ri
-
https://steamcommunity.com/profiles/76561198680197300
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Badlisted process makes network request 32 IoCs
Network request originating from process or tool commonly abused by malware.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d2e8fb0276b020ba2236162be04d11cb19e5d4327cb333d34f6af7c00ac534b3.bin.dll,#11⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/6128-0-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-1-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-2-0x00007FFCA7040000-0x00007FFCA7409000-memory.dmp
memory/6128-3-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-5-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-7-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-8-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-9-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-10-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-11-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-12-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-13-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-14-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-15-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-16-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-17-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-19-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-20-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-21-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-22-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-23-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-24-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-25-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-26-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-27-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-28-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-30-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-31-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-32-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-33-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-34-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-35-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-36-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-37-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-38-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-39-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-40-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-41-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-42-0x00007FFCA7040000-0x00007FFCA7409000-memory.dmp
memory/6128-43-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-44-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-45-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-46-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-47-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-48-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-49-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-50-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-51-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-52-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-53-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-54-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-55-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-56-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-57-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-58-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-59-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-60-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-61-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-63-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-64-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-65-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-66-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-67-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-68-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-69-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/6128-70-0x00000001A0000000-0x00000001A0226000-memory.dmp