Analysis
- custom tags
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 17:30
General
- Target c2594c352b8e6c8abd02c6d3e876d0aad94ec9b741dc6f7b2598a3133945a2f1.exe
- Size 5.0MB
- Sample260910-v3j1eaen8x
- SHA256 c2594c352b8e6c8abd02c6d3e876d0aad94ec9b741dc6f7b2598a3133945a2f1
Malware Config
Extracted
-
vidar
-
3.1
-
ad25c789a4a828b79a21e746b13a00f3
-
https://t.me/s11yne
-
https://dev.epicgames.com/community/api/user_profiles/profile.json?hash_id=roAjr
-
https://steamcommunity.com/profiles/76561198652917381
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:34.0) Gecko/20100101 Firefox/34.0
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Custom signatureDetects references to legitimate web services potentially used as dead drop resolvers 64 IoCs
Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2594c352b8e6c8abd02c6d3e876d0aad94ec9b741dc6f7b2598a3133945a2f1.exe"C:\Users\Admin\AppData\Local\Temp\c2594c352b8e6c8abd02c6d3e876d0aad94ec9b741dc6f7b2598a3133945a2f1.exe"1⤵
- Creates a file in the Startup directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1832-4-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-5-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-6-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-7-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-8-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-9-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-10-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-11-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-12-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-13-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-14-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-15-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-16-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-17-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-19-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-20-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-21-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-22-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-23-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-24-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-25-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-26-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-27-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-28-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-29-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-30-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-31-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-32-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-33-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-34-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-35-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-36-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-37-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-38-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-39-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-40-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-41-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-42-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-43-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-44-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-45-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-46-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-47-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-48-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-49-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-50-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-51-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-52-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-53-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-54-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-55-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-56-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-57-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-58-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-59-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-60-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-61-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-62-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-63-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-64-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-65-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-66-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-67-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-68-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-69-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/1832-70-0x00000001D0000000-0x00000001D0295000-memory.dmp