Analysis
-
max time kernel
137s -
max time network
153s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
12-02-2022 04:26
Static task
static1
Behavioral task
behavioral1
Sample
632410964cb2c718c8ae7b6c25848b8c7b902e9a9a766a32a9348e60f83fded5.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
632410964cb2c718c8ae7b6c25848b8c7b902e9a9a766a32a9348e60f83fded5.exe
-
Size
725KB
-
MD5
465d77435f210ccaa3a8e6cce05bd24f
-
SHA1
627f111aaafd02f0cf5b731ba5de8d6db8bf98a5
-
SHA256
632410964cb2c718c8ae7b6c25848b8c7b902e9a9a766a32a9348e60f83fded5
-
SHA512
e2a21b355027e9a13073b8ca379cba5f62df37be406b9bee28662a80a55b1a80af4033d60301d7f43e0917059b8386c8d4c52b8c1bf5abc80f1786da17cf3441
Malware Config
Extracted
Family
vidar
Version
49.1
Botnet
937
C2
https://noc.social/@sergeev46
https://c.im/@sergeev47
Attributes
-
profile_id
937
Signatures
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1308-57-0x0000000000220000-0x00000000002F9000-memory.dmp family_vidar behavioral1/memory/1308-58-0x0000000000400000-0x00000000004DD000-memory.dmp family_vidar
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1308-54-0x000000000099B000-0x0000000000A18000-memory.dmpFilesize
500KB
-
memory/1308-55-0x0000000075CE1000-0x0000000075CE3000-memory.dmpFilesize
8KB
-
memory/1308-56-0x000000000099B000-0x0000000000A18000-memory.dmpFilesize
500KB
-
memory/1308-57-0x0000000000220000-0x00000000002F9000-memory.dmpFilesize
868KB
-
memory/1308-58-0x0000000000400000-0x00000000004DD000-memory.dmpFilesize
884KB