Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/09/2026, 18:09
General
- Target jaffacakes118_7e2f861bc95152712cfbe8b838ca137b50a21eb276eae262b8ec0de6557b2f18.exe
- Size 2.2MB
- Sample260911-wrtwxabl9w
- SHA256 7e2f861bc95152712cfbe8b838ca137b50a21eb276eae262b8ec0de6557b2f18
Malware Config
Extracted
-
vidar
-
af320c29ab392e40e20b0a615c11c49d
-
hnadar
-
https://telegram.me/ahnadar
-
https://steamcommunity.com/profiles/76561198780411257
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0
Extracted
-
vidar
-
af320c29ab392e40e20b0a615c11c49d
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Detects Vidar Stealer 15 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7e2f861bc95152712cfbe8b838ca137b50a21eb276eae262b8ec0de6557b2f18.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7e2f861bc95152712cfbe8b838ca137b50a21eb276eae262b8ec0de6557b2f18.exe"1⤵
- Checks BIOS information in registry
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1000-0-0x00007FF7916B0000-0x00007FF791CAB000-memory.dmp
memory/1000-1-0x00007FF7916B0000-0x00007FF791CAB000-memory.dmp
memory/1000-2-0x00007FF7916B0000-0x00007FF791CAB000-memory.dmp
memory/1000-3-0x00007FF7916B0000-0x00007FF791CAB000-memory.dmp
memory/1000-13-0x00007FF7916B0000-0x00007FF791CAB000-memory.dmp
memory/1000-14-0x00007FF7916B0000-0x00007FF791CAB000-memory.dmp
memory/1000-20-0x00007FF7916B0000-0x00007FF791CAB000-memory.dmp
memory/1000-21-0x00007FF7916B0000-0x00007FF791CAB000-memory.dmp
memory/1000-25-0x00007FF7916B0000-0x00007FF791CAB000-memory.dmp
memory/1000-26-0x00007FF7916B0000-0x00007FF791CAB000-memory.dmp
memory/1000-27-0x00007FF7916B0000-0x00007FF791CAB000-memory.dmp
memory/1000-28-0x00007FF7916B0000-0x00007FF791CAB000-memory.dmp
memory/1000-29-0x00007FF7916B0000-0x00007FF791CAB000-memory.dmp
memory/1000-30-0x00007FF7916B0000-0x00007FF791CAB000-memory.dmp
memory/1000-31-0x00007FF7916B0000-0x00007FF791CAB000-memory.dmp
memory/1000-32-0x00007FF7916B0000-0x00007FF791CAB000-memory.dmp