Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 15:53
General
- Target 50f4e0b5108b250396e940b94fcbb1a1f8f3be8080d9103153f491948b42a1de.bin.dll
- Size 3.7MB
- Sample260910-tbtvvssarg
- SHA256 50f4e0b5108b250396e940b94fcbb1a1f8f3be8080d9103153f491948b42a1de
Malware Config
Extracted
-
vidar
-
2.4
-
3fa45fbf26da268c972baa9f07ae4b19
-
https://167.233.150.198
-
https://telegram.me/w09ksp
-
https://steamcommunity.com/profiles/76561198677476289
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Badlisted process makes network request 32 IoCs
Network request originating from process or tool commonly abused by malware.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\50f4e0b5108b250396e940b94fcbb1a1f8f3be8080d9103153f491948b42a1de.bin.dll,#11⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1196-0-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-1-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-2-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-3-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-4-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-5-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-6-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-7-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-9-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-8-0x00007FFD373B0000-0x00007FFD37788000-memory.dmp
memory/1196-10-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-11-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-12-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-13-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-14-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-16-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-17-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-18-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-19-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-20-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-21-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-22-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-23-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-24-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-25-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-26-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-27-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-28-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-29-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-30-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-31-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-32-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-34-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-35-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-36-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-37-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-38-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-39-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-40-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-42-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-43-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-44-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-45-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-46-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-47-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-48-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-49-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-50-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-51-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-52-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-54-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-55-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-56-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-57-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-58-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-59-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-60-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-62-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-61-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-63-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-64-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-65-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-66-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-67-0x0000000410000000-0x000000041021A000-memory.dmp
memory/1196-68-0x00007FFD373B0000-0x00007FFD37788000-memory.dmp
memory/1196-69-0x0000000410000000-0x000000041021A000-memory.dmp