vidar | 1a1e28b7d32ae446e3eac46307b3364c96e7679d63a4a6201d386aa0194096d1

Analysis

max time kernel
285s
max time network
286s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/11/2022, 08:34

Target

1a1e28b7d32ae446e3eac46307b3364c96e7679d63a4a6201d386aa0194096d1.exe
Size

2.7MB
MD5

223f32e2c8ecc690a672ee4f6ce236f0
SHA1

c1cb7f82ad5ad3f00d7bfb98fa8fb965f61da5b9
SHA256

1a1e28b7d32ae446e3eac46307b3364c96e7679d63a4a6201d386aa0194096d1
SHA512

9572a17e7a14002fd96959ae4e08a4366867b0497435e901080222df40318f11412640627553469d84c4c2ea005af94719ac2f684098daec8df0057ddde0bd09
SSDEEP

49152:ppXVRi7EH4d6mzGFNWCkikAumBBLaBxwvl3b:HXVRi7EH4EmYPkikeaBxwt

Score

10^/10

vidar 1375 stealer

Family

vidar

Version

54.6

Botnet

1375

https://t.me/huobiinside

https://mas.to/@kyriazhs1975

Attributes

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1512 set thread context of 98512	1512	1a1e28b7d32ae446e3eac46307b3364c96e7679d63a4a6201d386aa0194096d1.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 98512	1512	1a1e28b7d32ae446e3eac46307b3364c96e7679d63a4a6201d386aa0194096d1.exe	28
PID 1512 wrote to memory of 98512	1512	1a1e28b7d32ae446e3eac46307b3364c96e7679d63a4a6201d386aa0194096d1.exe	28
PID 1512 wrote to memory of 98512	1512	1a1e28b7d32ae446e3eac46307b3364c96e7679d63a4a6201d386aa0194096d1.exe	28
PID 1512 wrote to memory of 98512	1512	1a1e28b7d32ae446e3eac46307b3364c96e7679d63a4a6201d386aa0194096d1.exe	28
PID 1512 wrote to memory of 98512	1512	1a1e28b7d32ae446e3eac46307b3364c96e7679d63a4a6201d386aa0194096d1.exe	28
PID 1512 wrote to memory of 98512	1512	1a1e28b7d32ae446e3eac46307b3364c96e7679d63a4a6201d386aa0194096d1.exe	28
PID 1512 wrote to memory of 98512	1512	1a1e28b7d32ae446e3eac46307b3364c96e7679d63a4a6201d386aa0194096d1.exe	28
PID 1512 wrote to memory of 98512	1512	1a1e28b7d32ae446e3eac46307b3364c96e7679d63a4a6201d386aa0194096d1.exe	28
PID 1512 wrote to memory of 98512	1512	1a1e28b7d32ae446e3eac46307b3364c96e7679d63a4a6201d386aa0194096d1.exe	28

C:\Users\Admin\AppData\Local\Temp\1a1e28b7d32ae446e3eac46307b3364c96e7679d63a4a6201d386aa0194096d1.exe
"C:\Users\Admin\AppData\Local\Temp\1a1e28b7d32ae446e3eac46307b3364c96e7679d63a4a6201d386aa0194096d1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:98512

memory/98512-54-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/98512-56-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/98512-63-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/98512-64-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/98512-65-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download