vidar | 9e5c7ec1fd704ef7fa6463ed839875ddc039f276bf8e0f866f228e275b349454

Analysis

Target

400566d192aca40edf56b858214ed0b9.exe
Size

608KB
MD5

400566d192aca40edf56b858214ed0b9
SHA1

d6acd830e72934b4c8ad6cc8d4dac72f95568182
SHA256

9e5c7ec1fd704ef7fa6463ed839875ddc039f276bf8e0f866f228e275b349454
SHA512

6e1c412c910508f66a920ddd260dcd64b36a4c601a9816ebd7f8d656e43780daaf0da2309ebf3f3e56c82f760697028c43c4c24fd04bf5957ac6b097a26e5a4f
SSDEEP

12288:hQG1oZ0KtvusH5na1AMCkPwLpuWJpF2T4Pmc0jObZxNZXCRNRRS+0fMePJ:z1o5ngCkP4L90jOn6NRRSE6

Score

10^/10

vidar 1438 stealer

Family

vidar

Version

54.2

Botnet

1438

https://t.me/tigogames

https://ioc.exchange/@tiagoa26

Attributes

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1684 set thread context of 844	1684	400566d192aca40edf56b858214ed0b9.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 844	1684	400566d192aca40edf56b858214ed0b9.exe	28
PID 1684 wrote to memory of 844	1684	400566d192aca40edf56b858214ed0b9.exe	28
PID 1684 wrote to memory of 844	1684	400566d192aca40edf56b858214ed0b9.exe	28
PID 1684 wrote to memory of 844	1684	400566d192aca40edf56b858214ed0b9.exe	28
PID 1684 wrote to memory of 844	1684	400566d192aca40edf56b858214ed0b9.exe	28
PID 1684 wrote to memory of 844	1684	400566d192aca40edf56b858214ed0b9.exe	28
PID 1684 wrote to memory of 844	1684	400566d192aca40edf56b858214ed0b9.exe	28
PID 1684 wrote to memory of 844	1684	400566d192aca40edf56b858214ed0b9.exe	28
PID 1684 wrote to memory of 844	1684	400566d192aca40edf56b858214ed0b9.exe	28

C:\Users\Admin\AppData\Local\Temp\400566d192aca40edf56b858214ed0b9.exe
"C:\Users\Admin\AppData\Local\Temp\400566d192aca40edf56b858214ed0b9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:844

memory/844-54-0x0000000000090000-0x00000000000ED000-memory.dmp

Filesize
372KB

Download
memory/844-56-0x0000000000090000-0x00000000000ED000-memory.dmp

Filesize
372KB

Download
memory/844-63-0x0000000000090000-0x00000000000ED000-memory.dmp

Filesize
372KB

Download
memory/844-64-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/844-65-0x0000000000090000-0x00000000000ED000-memory.dmp

Filesize
372KB

Download