Overview

overview

10

Static

static

1371b2deb7...43.exe

windows7_x64

10

1371b2deb7...43.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    77s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    03-06-2022 06:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1371b2deb7ec3cddad0e5de911439e797065edc220f54516de0dcdacb7116243.exe

  • Size

    770KB

  • MD5

    897fc91b849fad54893e02cb85c69970

  • SHA1

    921a9a6fee66701b7c5eb3a7ebba151b300d9a2a

  • SHA256

    1371b2deb7ec3cddad0e5de911439e797065edc220f54516de0dcdacb7116243

  • SHA512

    a64916ef3c036e09c7c43f52211c3d97f77fefd47d4f45d1a037743cd969f985001d2bd33b8401568ec4cc0b875ff9fc580c9a9400188bb9a6707d09117100d5

Score
10/10
vidar937stealer

Malware Config

Extracted

Family

vidar

Version

41.5

Botnet

937

C2

https://mas.to/@xeroxxx

Attributes
  • profile_id

    937

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar Stealer 3 IoCs
    stealer
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1371b2deb7ec3cddad0e5de911439e797065edc220f54516de0dcdacb7116243.exe
    "C:\Users\Admin\AppData\Local\Temp\1371b2deb7ec3cddad0e5de911439e797065edc220f54516de0dcdacb7116243.exe"
    1⤵
      PID:2192
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 1008
        2⤵
        • Program crash
        PID:4372
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2192 -ip 2192
      1⤵
        PID:4356

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2192-130-0x0000000001262000-0x00000000012DE000-memory.dmp
        Filesize

        496KB

        Download
      • memory/2192-131-0x0000000001170000-0x0000000001246000-memory.dmp
        Filesize

        856KB

        Download
      • memory/2192-132-0x0000000000400000-0x0000000001091000-memory.dmp
        Filesize

        12.6MB

        Download
      • memory/2192-133-0x0000000001262000-0x00000000012DE000-memory.dmp
        Filesize

        496KB

        Download
      • memory/2192-134-0x0000000000400000-0x0000000001091000-memory.dmp
        Filesize

        12.6MB

        Download