vidar | 63d17503bd4ae9dc9b7e834d6eefda8ec214746e73945b333af447ddab0b2bab

Analysis

max time kernel
149s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 20:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19adeda48b49acb20e16f.exe
Size 258KB
Sample221202-y1c1vsaf25
SHA256 7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19adeda48b49acb20e16f
MD5 b9212ded69fae1fa1fb5d6db46a9fb76
SHA1 58face4245646b1cd379ee49f03a701eab1642be
SHA512 09cab8ccedb9e53d6d2725e8b9dbbe8fa9552607a58d89876b6539a6612b2e7ac0440ef281971bec9191510915fa6264048510add493e6a862b0d3b4f006e342
SSDEEP 6144:YdAhH6pftFbsb8XODU4aLTwzLs0+mKnBtt:VUpftVcwIU4aLTwz5tItt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar 517 stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

https://t.me/asifrazatg
https://steamcommunity.com/profiles/76561199439929669

Attributes

profile_id
517

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4556 set thread context of 4752	4556	7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19adeda48b49acb20e16f.exe	80

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 4752	4556	7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19adeda48b49acb20e16f.exe	80
PID 4556 wrote to memory of 4752	4556	7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19adeda48b49acb20e16f.exe	80
PID 4556 wrote to memory of 4752	4556	7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19adeda48b49acb20e16f.exe	80
PID 4556 wrote to memory of 4752	4556	7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19adeda48b49acb20e16f.exe	80
PID 4556 wrote to memory of 4752	4556	7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19adeda48b49acb20e16f.exe	80
PID 4556 wrote to memory of 4752	4556	7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19adeda48b49acb20e16f.exe	80
PID 4556 wrote to memory of 4752	4556	7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19adeda48b49acb20e16f.exe	80
PID 4556 wrote to memory of 4752	4556	7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19adeda48b49acb20e16f.exe	80
PID 4556 wrote to memory of 4752	4556	7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19adeda48b49acb20e16f.exe	80

C:\Users\Admin\AppData\Local\Temp\7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19adeda48b49acb20e16f.exe
"C:\Users\Admin\AppData\Local\Temp\7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19adeda48b49acb20e16f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19adeda48b49acb20e16f.exe
  "C:\Users\Admin\AppData\Local\Temp\7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19adeda48b49acb20e16f.exe"
  2⤵
  PID:4752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4556-136-0x00000000004FD000-0x000000000052A000-memory.dmp

Download

memory/4556-137-0x00000000020B0000-0x00000000020FB000-memory.dmp

Download

memory/4752-133-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/4752-134-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/4752-135-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/4752-138-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/4752-139-0x0000000000400000-0x000000000045F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads