Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/10/2026, 19:52
General
- Target file.exe
- Size 556KB
- Sample261003-ylhmsswerc
- SHA256 1aa59edff3c33ebff948fdfa1aca7aad97f248b3275a31e587c40c0f852b8114
Malware Config
Extracted
-
vidar
-
3.7
-
d362134c0f45c0b85d054070aa6ab3ae
-
https://79.133.42.171
-
https://telegram.me/bj00tyr
-
https://community.fandom.com/wikia.php?controller=UserProfile&method=getUserData&format=json&userId=64444700
-
https://steamcommunity.com/profiles/76561198630398488
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4668-3-0x0000000390000000-0x00000003902A0000-memory.dmp
memory/4668-9-0x0000000390000000-0x00000003902A0000-memory.dmp
memory/4668-12-0x0000000390000000-0x00000003902A0000-memory.dmp
memory/4668-13-0x00007FF750000000-0x00007FF750093000-memory.dmp
memory/4900-0-0x00007FF750000000-0x00007FF750093000-memory.dmp