Overview

overview

10

Static

static

10

1500-56-0x...ry.exe

windows7-x64

10

1500-56-0x...ry.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    61s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-10-2022 02:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1500-56-0x0000000000A70000-0x0000000001398000-memory.exe

  • Size

    9.2MB

  • MD5

    6d929114a3284888f3f8c10261384391

  • SHA1

    0f928f41f1a7fd8d3e71e1a15fe94e11bf4d9b68

  • SHA256

    97884b8e18ad0f52de4d49417cdffeae030905cde46da43d88f5938349542def

  • SHA512

    07d43745246fec2cb93b736d518c02202ac398b5a0ef021796b5790c3e616b2c819a8af4d2ee49b52cd5b5d15185c0f69cf5f8af10c3000f9ccf0ab9ae7a27e0

  • SSDEEP

    98304:XRYgVvxczu4hvG4TgsCLMjG7ZSj8UruU2fHyQEY0JIi4VaLGGteqp8OH7FCUG:jKtPFru/HKGi4VqGG9XFX

Score
10/10
vidarstealerthemida

Malware Config

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Program crash 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1500-56-0x0000000000A70000-0x0000000001398000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\1500-56-0x0000000000A70000-0x0000000001398000-memory.exe"
    1⤵
      PID:2040
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 220
        2⤵
        • Program crash
        PID:2184
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 244
        2⤵
        • Program crash
        PID:2400
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2040 -ip 2040
      1⤵
        PID:852
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2040 -ip 2040
        1⤵
          PID:5108

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2040-132-0x0000000000880000-0x00000000011A8000-memory.dmp

          Filesize

          9.2MB

          Download