Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 18:10
General
- Target a2e427957edf70e656fb0d8aee9e2ce5bcc132894d0204020b835974e01be2d2.bin.dll
- Size 3.7MB
- Sample260820-wscc9ashka
- SHA256 a2e427957edf70e656fb0d8aee9e2ce5bcc132894d0204020b835974e01be2d2
Malware Config
Extracted
-
vidar
-
2.1
-
025d9ecb1d4c770d450f8ed16ee63dea
-
https://5.75.221.125
-
https://telegram.me/turb00m
-
https://steamcommunity.com/profiles/76561198689449626
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Badlisted process makes network request 22 IoCs
Network request originating from process or tool commonly abused by malware.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a2e427957edf70e656fb0d8aee9e2ce5bcc132894d0204020b835974e01be2d2.bin.dll,#11⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1652-0-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-1-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-3-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-2-0x00007FFC688D0000-0x00007FFC68C92000-memory.dmp
memory/1652-4-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-5-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-6-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-7-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-8-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-9-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-10-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-11-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-12-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-13-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-14-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-16-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-17-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-18-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-19-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-20-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-21-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-22-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-24-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-25-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-26-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-27-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-28-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-29-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-31-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-32-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-33-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-34-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-35-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-36-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-38-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-39-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-40-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-41-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-42-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-43-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-44-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-46-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-45-0x00007FFC688D0000-0x00007FFC68C92000-memory.dmp
memory/1652-47-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-50-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-51-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-52-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-54-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-55-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-56-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-57-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-58-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-59-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-60-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-61-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-62-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-63-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-64-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-66-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-67-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-68-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-69-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-70-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-71-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-73-0x00000006B0000000-0x00000006B0222000-memory.dmp
memory/1652-74-0x00000006B0000000-0x00000006B0222000-memory.dmp