Analysis
- custom tags
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 17:30
General
- Target c2594c352b8e6c8abd02c6d3e876d0aad94ec9b741dc6f7b2598a3133945a2f1.exe
- Size 5.0MB
- Sample260910-v3j1eaen8x
- SHA256 c2594c352b8e6c8abd02c6d3e876d0aad94ec9b741dc6f7b2598a3133945a2f1
Malware Config
Extracted
-
vidar
-
3.1
-
ad25c789a4a828b79a21e746b13a00f3
-
https://t.me/s11yne
-
https://dev.epicgames.com/community/api/user_profiles/profile.json?hash_id=roAjr
-
https://steamcommunity.com/profiles/76561198652917381
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:34.0) Gecko/20100101 Firefox/34.0
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Detects references to legitimate web services potentially used as dead drop resolvers 64 IoCs
Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2594c352b8e6c8abd02c6d3e876d0aad94ec9b741dc6f7b2598a3133945a2f1.exe"C:\Users\Admin\AppData\Local\Temp\c2594c352b8e6c8abd02c6d3e876d0aad94ec9b741dc6f7b2598a3133945a2f1.exe"1⤵
- Creates a file in the Startup directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4636-4-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-5-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-6-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-7-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-8-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-9-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-10-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-11-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-12-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-13-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-14-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-15-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-16-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-17-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-18-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-19-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-20-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-21-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-22-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-23-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-24-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-25-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-26-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-27-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-28-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-29-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-30-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-31-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-32-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-33-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-34-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-35-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-36-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-37-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-38-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-39-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-40-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-41-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-42-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-43-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-44-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-45-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-46-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-47-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-48-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-49-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-50-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-51-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-52-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-53-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-54-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-55-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-57-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-56-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-58-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-59-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-60-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-61-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-62-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-63-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-64-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-65-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-66-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-67-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-68-0x00000001D0000000-0x00000001D0295000-memory.dmp
memory/4636-69-0x00000001D0000000-0x00000001D0295000-memory.dmp