vidar | 0b98114cfbe3e32c681ebb5a4a867391da2d235b771227af97f46825b95de3f2

Analysis

max time kernel
151s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2022 16:22

Target

file.exe
Size

301KB
MD5

9964dec7f63403963374ebae4ba27e44
SHA1

51c8d242bbbc34b9d0135bcdaa53b5e78449b73d
SHA256

0b98114cfbe3e32c681ebb5a4a867391da2d235b771227af97f46825b95de3f2
SHA512

41cc95c052b85997c47cceaa0665788607b577005e93ae08b48b54d10a3ead190f56219238d3579e45ce18601220474f8e860ad8efb1d22c475070d79c202937
SSDEEP

6144:LULLZmLoTDBbi+HYAfLrCnMvIX5t+9PIe1v3x1m:QsLoTDBbvLsCut+S

Score

10^/10

vidar 517 stealer

Family

vidar

Version

55.6

Botnet

517

https://t.me/seclab_new

https://mas.to/@ofadex

Attributes

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 4444 set thread context of 3776 4444 file.exe file.exe

description	pid	process	target process
PID 4444 set thread context of 3776	4444	file.exe	file.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

file.exe

description	pid	process	target process
PID 4444 wrote to memory of 3776	4444	file.exe	file.exe
PID 4444 wrote to memory of 3776	4444	file.exe	file.exe
PID 4444 wrote to memory of 3776	4444	file.exe	file.exe
PID 4444 wrote to memory of 3776	4444	file.exe	file.exe
PID 4444 wrote to memory of 3776	4444	file.exe	file.exe
PID 4444 wrote to memory of 3776	4444	file.exe	file.exe
PID 4444 wrote to memory of 3776	4444	file.exe	file.exe
PID 4444 wrote to memory of 3776	4444	file.exe	file.exe
PID 4444 wrote to memory of 3776	4444	file.exe	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
PID:3776

memory/3776-132-0x0000000000000000-mapping.dmp

Download
memory/3776-133-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3776-134-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3776-136-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3776-138-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3776-139-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/4444-135-0x00000000005DD000-0x000000000060A000-memory.dmp

Filesize
180KB

Download
memory/4444-137-0x00000000021B0000-0x00000000021FC000-memory.dmp

Filesize
304KB

Download