Overview

overview

10

Static

static

226a8293b9...ad.exe

windows7_x64

10

226a8293b9...ad.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    95s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    12-06-2022 05:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    226a8293b96709284b0a726013df26047ff8d4837a337a89dc810d4ce7800fad.exe

  • Size

    2.1MB

  • MD5

    23456ad6c1674099ea46af2c39aea29b

  • SHA1

    a017e8ba079165d82d3398a83b3f057c7edb4b0e

  • SHA256

    226a8293b96709284b0a726013df26047ff8d4837a337a89dc810d4ce7800fad

  • SHA512

    f5554062802097c67f1a80d428647821e87729ecd7e4eee075d54262a27e79b6fbaf274ba79d21b8aa7c3a982ba2943a7f397fe20eacf5cddd872ac4df500e7f

Score
10/10
vidar1120stealer

Malware Config

Extracted

Family

vidar

Version

50.1

Botnet

1120

C2

https://mastodon.online/@k1llerniax

https://koyu.space/@k1llerni2x
Attributes
  • profile_id

    1120

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar Stealer 5 IoCs
    stealer
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\226a8293b96709284b0a726013df26047ff8d4837a337a89dc810d4ce7800fad.exe
    "C:\Users\Admin\AppData\Local\Temp\226a8293b96709284b0a726013df26047ff8d4837a337a89dc810d4ce7800fad.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2596-130-0x0000000000CC0000-0x0000000000EB5000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/2596-132-0x0000000000CC0000-0x0000000000EB5000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/2596-131-0x0000000000CC0000-0x0000000000EB5000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/2596-133-0x0000000000CC0000-0x0000000000EB5000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/2596-134-0x0000000076B80000-0x0000000076D95000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/2596-135-0x0000000075AD0000-0x0000000075D51000-memory.dmp
    Filesize

    2.5MB

    Download
  • memory/2596-136-0x0000000001460000-0x00000000014AD000-memory.dmp
    Filesize

    308KB

    Download
  • memory/2596-137-0x0000000000CC0000-0x0000000000EB5000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/2596-138-0x00000000759E0000-0x0000000075AC3000-memory.dmp
    Filesize

    908KB

    Download
  • memory/2596-139-0x0000000000CC0000-0x0000000000EB5000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/2596-140-0x0000000001460000-0x00000000014AD000-memory.dmp
    Filesize

    308KB

    Download
  • memory/2596-141-0x0000000000CC0000-0x0000000000EB5000-memory.dmp
    Filesize

    2.0MB

    Download