vidar | e358ccc2222e1f8acc1ccbe3596f50fbb24d7e744850df3c04eca6c5eeeba2e5

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:51

Target

GitHub Desktop.exe
Size

3.5MB
MD5

b4997c79cfc3aadcf67ea98b35d02416
SHA1

7c439b88a9f8bfadb02ae1a3eab10130fcc7fcec
SHA256

e358ccc2222e1f8acc1ccbe3596f50fbb24d7e744850df3c04eca6c5eeeba2e5
SHA512

58770e14fabf655a9331cba7e283c3dfc8f4eef5a5c63502a5cf7e34b43a2bc6e6b431e392f5e06c02119ca1f87c329fa26f0b3c9653b4d9fbb1b029c8626c38
SSDEEP

49152:fdGRbHsngxm8dAEWPZkjf7xvPSPYl/mJpA6ZD5Uu66n3:oRbMnd8dAEWPZkZKP2mJpACDv/3

Score

10^/10

vidar 1340 stealer

Family

vidar

Version

55.7

Botnet

1340

https://t.me/deadftx

https://www.tiktok.com/@user6068972597711

Attributes

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

GitHub Desktop.exe

pid process

4408 GitHub Desktop.exe
4408 GitHub Desktop.exe
4408 GitHub Desktop.exe
4408 GitHub Desktop.exe
4408 GitHub Desktop.exe
4408 GitHub Desktop.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

GitHub Desktop.exe

description pid process target process

PID 4408 set thread context of 4672 4408 GitHub Desktop.exe GitHub Desktop.exe

description	pid	process	target process
PID 4408 set thread context of 4672	4408	GitHub Desktop.exe	GitHub Desktop.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

GitHub Desktop.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

GitHub Desktop.exe

description pid process

Token: SeDebugPrivilege 4408 GitHub Desktop.exe

description	pid	process
Token: SeDebugPrivilege	4408	GitHub Desktop.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

GitHub Desktop.exe

description	pid	process	target process
PID 4408 wrote to memory of 3276	4408	GitHub Desktop.exe	GitHub Desktop.exe
PID 4408 wrote to memory of 3276	4408	GitHub Desktop.exe	GitHub Desktop.exe
PID 4408 wrote to memory of 3276	4408	GitHub Desktop.exe	GitHub Desktop.exe
PID 4408 wrote to memory of 4672	4408	GitHub Desktop.exe	GitHub Desktop.exe
PID 4408 wrote to memory of 4672	4408	GitHub Desktop.exe	GitHub Desktop.exe
PID 4408 wrote to memory of 4672	4408	GitHub Desktop.exe	GitHub Desktop.exe
PID 4408 wrote to memory of 4672	4408	GitHub Desktop.exe	GitHub Desktop.exe
PID 4408 wrote to memory of 4672	4408	GitHub Desktop.exe	GitHub Desktop.exe
PID 4408 wrote to memory of 4672	4408	GitHub Desktop.exe	GitHub Desktop.exe
PID 4408 wrote to memory of 4672	4408	GitHub Desktop.exe	GitHub Desktop.exe
PID 4408 wrote to memory of 4672	4408	GitHub Desktop.exe	GitHub Desktop.exe
PID 4408 wrote to memory of 4672	4408	GitHub Desktop.exe	GitHub Desktop.exe

C:\Users\Admin\AppData\Local\Temp\GitHub Desktop.exe
"C:\Users\Admin\AppData\Local\Temp\GitHub Desktop.exe"
2⤵
PID:3276

C:\Users\Admin\AppData\Local\Temp\GitHub Desktop.exe
"C:\Users\Admin\AppData\Local\Temp\GitHub Desktop.exe"
2⤵
PID:4672

memory/3276-133-0x0000000000000000-mapping.dmp

Download
memory/4408-132-0x0000000000210000-0x00000000005A2000-memory.dmp

Filesize
3.6MB

Download
memory/4672-134-0x0000000000000000-mapping.dmp

Download
memory/4672-135-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4672-136-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4672-137-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4672-138-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download