Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/09/2026, 13:52
General
- Target eb62e1c646d0e5f3ddd0ab11685ce6ecf36d56bd3d3150c235294b2e3f00427a.bin.dll
- Size 4.3MB
- Sample260925-q6jftstvct
- SHA256 eb62e1c646d0e5f3ddd0ab11685ce6ecf36d56bd3d3150c235294b2e3f00427a
Malware Config
Extracted
-
vidar
-
2.7
-
9883ed9357a3dd77b1d2b23683ea5450
-
https://65.108.201.76
-
https://t.me/gk6p2s
-
https://steamcommunity.com/profiles/76561198667588759
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Badlisted process makes network request 63 IoCs
Network request originating from process or tool commonly abused by malware.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb62e1c646d0e5f3ddd0ab11685ce6ecf36d56bd3d3150c235294b2e3f00427a.bin.dll,#11⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3256-0-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-1-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-2-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-3-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-4-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-5-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-6-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-7-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-8-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-10-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-9-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-11-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-12-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-14-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-13-0x00007FFF4E810000-0x00007FFF4EC79000-memory.dmp
memory/3256-15-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-16-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-17-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-18-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-19-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-20-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-21-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-22-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-23-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-24-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-25-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-26-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-27-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-28-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-29-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-30-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-31-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-32-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-33-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-34-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-35-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-36-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-37-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-39-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-40-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-41-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-42-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-43-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-44-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-45-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-46-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-47-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-48-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-49-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-50-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-51-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-52-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-53-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-54-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-55-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-56-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-58-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-59-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-60-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-61-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-62-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-63-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-64-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-65-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-66-0x00000001E0000000-0x00000001E021F000-memory.dmp
memory/3256-67-0x00000001E0000000-0x00000001E021F000-memory.dmp