vidar | 08455b4a70ecb4f6ead66f078fd16257334d4afc6b72aaad13eb6617d7c1e1f6

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/11/2022, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 512KB
Sample221111-ds2c9sgfa7
SHA256 08455b4a70ecb4f6ead66f078fd16257334d4afc6b72aaad13eb6617d7c1e1f6
MD5 d608dad844a28bb473d55c0a84d192b6
SHA1 aaa694c61174236c63a8574c1cfe9707047d0ab2
SHA512 5eefa5c8e9f41e660de095755bd17642623dd149c1ce0c349e6ef13e60d74e76e8cdf0775e595ca1fd14190d943ff687f16f628fccfa5ae4a8b45b6a86cdf6c7
SSDEEP 12288:hQZXA6LLM8IGHCN3+lnclruopChYpQ3Nk9/b1RJo:AAuVHCN+lnU6vsbH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar 1375 stealer

Malware Config

Extracted

Family

vidar

Version

55.6

Botnet

1375

https://t.me/alertbabka7743

Attributes

profile_id
1375

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 1836	1980	Setup.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1104	1980	WerFault.exe	27

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1836	1980	Setup.exe	29
PID 1980 wrote to memory of 1836	1980	Setup.exe	29
PID 1980 wrote to memory of 1836	1980	Setup.exe	29
PID 1980 wrote to memory of 1836	1980	Setup.exe	29
PID 1980 wrote to memory of 1836	1980	Setup.exe	29
PID 1980 wrote to memory of 1836	1980	Setup.exe	29
PID 1980 wrote to memory of 1836	1980	Setup.exe	29
PID 1980 wrote to memory of 1836	1980	Setup.exe	29
PID 1980 wrote to memory of 1836	1980	Setup.exe	29
PID 1980 wrote to memory of 1104	1980	Setup.exe	30
PID 1980 wrote to memory of 1104	1980	Setup.exe	30
PID 1980 wrote to memory of 1104	1980	Setup.exe	30
PID 1980 wrote to memory of 1104	1980	Setup.exe	30
PID 1980 wrote to memory of 1104	1980	Setup.exe	30
PID 1980 wrote to memory of 1104	1980	Setup.exe	30
PID 1980 wrote to memory of 1104	1980	Setup.exe	30

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 36
  2⤵
  - Program crash
  PID:1104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1836-57-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1836-55-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1836-64-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1836-66-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1980-54-0x0000000075981000-0x0000000075983000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads