vidar | e358ccc2222e1f8acc1ccbe3596f50fbb24d7e744850df3c04eca6c5eeeba2e5

Analysis

max time kernel
159s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:49

Target

GitHub Desktop.exe
Size

3.5MB
MD5

b4997c79cfc3aadcf67ea98b35d02416
SHA1

7c439b88a9f8bfadb02ae1a3eab10130fcc7fcec
SHA256

e358ccc2222e1f8acc1ccbe3596f50fbb24d7e744850df3c04eca6c5eeeba2e5
SHA512

58770e14fabf655a9331cba7e283c3dfc8f4eef5a5c63502a5cf7e34b43a2bc6e6b431e392f5e06c02119ca1f87c329fa26f0b3c9653b4d9fbb1b029c8626c38
SSDEEP

49152:fdGRbHsngxm8dAEWPZkjf7xvPSPYl/mJpA6ZD5Uu66n3:oRbMnd8dAEWPZkZKP2mJpACDv/3

Score

10^/10

vidar 1340 stealer

Family

vidar

Version

55.7

Botnet

1340

https://t.me/deadftx

https://www.tiktok.com/@user6068972597711

Attributes

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

GitHub Desktop.exe

pid process

4672 GitHub Desktop.exe
4672 GitHub Desktop.exe
4672 GitHub Desktop.exe
4672 GitHub Desktop.exe
4672 GitHub Desktop.exe
4672 GitHub Desktop.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

GitHub Desktop.exe

description pid process target process

PID 4672 set thread context of 1624 4672 GitHub Desktop.exe GitHub Desktop.exe

description	pid	process	target process
PID 4672 set thread context of 1624	4672	GitHub Desktop.exe	GitHub Desktop.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

GitHub Desktop.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

GitHub Desktop.exe

description pid process

Token: SeDebugPrivilege 4672 GitHub Desktop.exe

description	pid	process
Token: SeDebugPrivilege	4672	GitHub Desktop.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

GitHub Desktop.exe

description	pid	process	target process
PID 4672 wrote to memory of 1624	4672	GitHub Desktop.exe	GitHub Desktop.exe
PID 4672 wrote to memory of 1624	4672	GitHub Desktop.exe	GitHub Desktop.exe
PID 4672 wrote to memory of 1624	4672	GitHub Desktop.exe	GitHub Desktop.exe
PID 4672 wrote to memory of 1624	4672	GitHub Desktop.exe	GitHub Desktop.exe
PID 4672 wrote to memory of 1624	4672	GitHub Desktop.exe	GitHub Desktop.exe
PID 4672 wrote to memory of 1624	4672	GitHub Desktop.exe	GitHub Desktop.exe
PID 4672 wrote to memory of 1624	4672	GitHub Desktop.exe	GitHub Desktop.exe
PID 4672 wrote to memory of 1624	4672	GitHub Desktop.exe	GitHub Desktop.exe
PID 4672 wrote to memory of 1624	4672	GitHub Desktop.exe	GitHub Desktop.exe

C:\Users\Admin\AppData\Local\Temp\GitHub Desktop.exe
"C:\Users\Admin\AppData\Local\Temp\GitHub Desktop.exe"
2⤵
PID:1624

memory/1624-133-0x0000000000000000-mapping.dmp

Download
memory/1624-134-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1624-135-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1624-136-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1624-137-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1624-138-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4672-132-0x0000000000030000-0x00000000003C2000-memory.dmp

Filesize
3.6MB

Download