Analysis
-
max time kernel
145s -
max time network
178s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
12-02-2022 12:56
Static task
static1
Behavioral task
behavioral1
Sample
0a3eabfcb785a6d82ce28392c4d95589abb09f6084c027a2fee745c464b2ccc1.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
0a3eabfcb785a6d82ce28392c4d95589abb09f6084c027a2fee745c464b2ccc1.exe
-
Size
763KB
-
MD5
fbc41b8c9ea0b4e8c5154f072b1cc4d6
-
SHA1
ff9ba35e58ce4af246660a3d4f7a44396eb3f24c
-
SHA256
0a3eabfcb785a6d82ce28392c4d95589abb09f6084c027a2fee745c464b2ccc1
-
SHA512
6d51e87d1f10b514fae20762c2c0e744134981fc7fd5adb0c2362906688329cc6d505ea53fd3b8eb98955a8a8c36499112cb3e98b93bb5c0cd32dd6838a744f8
Malware Config
Extracted
Family
vidar
Version
49.2
Botnet
933
C2
https://mstdn.social/@kipriauk9
https://qoto.org/@kipriauk8
Attributes
-
profile_id
933
Signatures
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1660-58-0x00000000005B0000-0x0000000000685000-memory.dmp family_vidar behavioral1/memory/1660-59-0x0000000000400000-0x00000000004D9000-memory.dmp family_vidar
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1660-55-0x00000000002E8000-0x0000000000365000-memory.dmpFilesize
500KB
-
memory/1660-56-0x0000000076141000-0x0000000076143000-memory.dmpFilesize
8KB
-
memory/1660-57-0x00000000002E8000-0x0000000000365000-memory.dmpFilesize
500KB
-
memory/1660-58-0x00000000005B0000-0x0000000000685000-memory.dmpFilesize
852KB
-
memory/1660-59-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB