Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 03:08
General
- Target cb6df19146b3247b93780ae8f3085138929717500ec5a3e14cca1e313f244962.bin.dll
- Size 3.6MB
- Sample260812-dndreaab99
- SHA256 cb6df19146b3247b93780ae8f3085138929717500ec5a3e14cca1e313f244962
Malware Config
Extracted
-
vidar
-
2.3
-
481e0dc23c0cffbc154e9dff7bffc259
-
https://167.233.150.198
-
https://telegram.me/af97ri
-
https://steamcommunity.com/profiles/76561198680197300
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Badlisted process makes network request 19 IoCs
Network request originating from process or tool commonly abused by malware.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cb6df19146b3247b93780ae8f3085138929717500ec5a3e14cca1e313f244962.bin.dll,#11⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3380-0-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-1-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-2-0x00007FF88FD70000-0x00007FF890128000-memory.dmp
memory/3380-3-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-4-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-5-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-6-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-7-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-8-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-9-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-10-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-11-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-12-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-13-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-14-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-16-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-17-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-18-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-19-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-20-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-21-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-22-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-23-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-24-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-25-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-26-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-27-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-28-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-30-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-31-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-33-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-32-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-34-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-35-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-37-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-38-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-39-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-40-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-41-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-42-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-44-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-45-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-46-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-47-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-48-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-49-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-50-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-51-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-52-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-53-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-54-0x00007FF88FD70000-0x00007FF890128000-memory.dmp
memory/3380-55-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-56-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-57-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-58-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-59-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-60-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-61-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-63-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-64-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-65-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-66-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-67-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-68-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-69-0x00000001A0000000-0x00000001A0226000-memory.dmp
memory/3380-71-0x00000001A0000000-0x00000001A0226000-memory.dmp