Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
10/09/2026, 15:52
General
- Target 64ac5f0a494ec9ed4c14900926ae19a24e0c713ff5e1148021c525a3f876536a.bin.dll
- Size 3.7MB
- Sample260910-tbhslasarc
- SHA256 64ac5f0a494ec9ed4c14900926ae19a24e0c713ff5e1148021c525a3f876536a
Malware Config
Extracted
-
vidar
-
2.4
-
69b6dbd4f36ea626bdcc1933c4193632
-
https://91.98.111.49
-
https://telegram.me/w09ksp
-
https://steamcommunity.com/profiles/76561198677476289
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Badlisted process makes network request 19 IoCs
Network request originating from process or tool commonly abused by malware.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\64ac5f0a494ec9ed4c14900926ae19a24e0c713ff5e1148021c525a3f876536a.bin.dll,#11⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4868-0-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-1-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-3-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-2-0x00007FFEE8F70000-0x00007FFEE934A000-memory.dmp
memory/4868-5-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-7-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-8-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-9-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-10-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-11-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-13-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-14-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-15-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-16-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-17-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-18-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-19-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-20-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-22-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-23-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-24-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-25-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-26-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-27-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-28-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-29-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-30-0x00007FFEE8F70000-0x00007FFEE934A000-memory.dmp
memory/4868-31-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-32-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-33-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-34-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-35-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-36-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-37-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-38-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-40-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-41-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-42-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-43-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-44-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-45-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-47-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-48-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-49-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-50-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-51-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-52-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-53-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-54-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-55-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-57-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-58-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-59-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-60-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-61-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-62-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-63-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-64-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-66-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-67-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-68-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-69-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-70-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-71-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-73-0x0000000360000000-0x0000000360228000-memory.dmp
memory/4868-74-0x0000000360000000-0x0000000360228000-memory.dmp