vidar | 9e5c7ec1fd704ef7fa6463ed839875ddc039f276bf8e0f866f228e275b349454

Analysis

Target

400566d192aca40edf56b858214ed0b9.exe
Size

608KB
MD5

400566d192aca40edf56b858214ed0b9
SHA1

d6acd830e72934b4c8ad6cc8d4dac72f95568182
SHA256

9e5c7ec1fd704ef7fa6463ed839875ddc039f276bf8e0f866f228e275b349454
SHA512

6e1c412c910508f66a920ddd260dcd64b36a4c601a9816ebd7f8d656e43780daaf0da2309ebf3f3e56c82f760697028c43c4c24fd04bf5957ac6b097a26e5a4f
SSDEEP

12288:hQG1oZ0KtvusH5na1AMCkPwLpuWJpF2T4Pmc0jObZxNZXCRNRRS+0fMePJ:z1o5ngCkP4L90jOn6NRRSE6

Score

10^/10

vidar 1438 stealer

Family

vidar

Version

54.2

Botnet

1438

https://t.me/tigogames

https://ioc.exchange/@tiagoa26

Attributes

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Suspicious use of SetThreadContext 1 IoCs

Processes:

400566d192aca40edf56b858214ed0b9.exe

description pid process target process

PID 1684 set thread context of 844 1684 400566d192aca40edf56b858214ed0b9.exe AppLaunch.exe

description	pid	process	target process
PID 1684 set thread context of 844	1684	400566d192aca40edf56b858214ed0b9.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

400566d192aca40edf56b858214ed0b9.exe

description	pid	process	target process
PID 1684 wrote to memory of 844	1684	400566d192aca40edf56b858214ed0b9.exe	AppLaunch.exe
PID 1684 wrote to memory of 844	1684	400566d192aca40edf56b858214ed0b9.exe	AppLaunch.exe
PID 1684 wrote to memory of 844	1684	400566d192aca40edf56b858214ed0b9.exe	AppLaunch.exe
PID 1684 wrote to memory of 844	1684	400566d192aca40edf56b858214ed0b9.exe	AppLaunch.exe
PID 1684 wrote to memory of 844	1684	400566d192aca40edf56b858214ed0b9.exe	AppLaunch.exe
PID 1684 wrote to memory of 844	1684	400566d192aca40edf56b858214ed0b9.exe	AppLaunch.exe
PID 1684 wrote to memory of 844	1684	400566d192aca40edf56b858214ed0b9.exe	AppLaunch.exe
PID 1684 wrote to memory of 844	1684	400566d192aca40edf56b858214ed0b9.exe	AppLaunch.exe
PID 1684 wrote to memory of 844	1684	400566d192aca40edf56b858214ed0b9.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:844

memory/844-54-0x0000000000090000-0x00000000000ED000-memory.dmp

Filesize
372KB

Download
memory/844-56-0x0000000000090000-0x00000000000ED000-memory.dmp

Filesize
372KB

Download
memory/844-62-0x00000000000B2DBD-mapping.dmp

Download
memory/844-63-0x0000000000090000-0x00000000000ED000-memory.dmp

Filesize
372KB

Download
memory/844-64-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/844-65-0x0000000000090000-0x00000000000ED000-memory.dmp

Filesize
372KB

Download