vidar | e433512ad2b47afbc778ab161a218944b504c90f513ff320d2aa8bfc55d5cb25

Resubmissions

04/01/2023, 21:42

230104-1kldeahg6510

04/01/2023, 21:39

230104-1hvt3adc2s1

Analysis

max time kernel
31s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/01/2023, 21:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 457.0MB
Sample230104-1kldeahg65
SHA256 6afd1ceacb145d84e706c553247459bbd492733e50f21de8a42424ba7de87c62
MD5 82121649ff44e92e9b029fcdf0e25cce
SHA1 4b69c4e931e15655d050e8683663982fd1195f9d
SHA512 7c0c78ceda34e6be862fbd3bf912b3f3464c63d7e55a33dcf73d4dc9ff7b788598c3d076b4ce3370d42e56c567c73bd7c0854bdefacd73cdfa3973742015628a
SSDEEP 24576:h7/KGExULMntaZj2MQLnZPxiSJMuf/mi/pi/+5e+/LI:h7uw0AfBaxCA8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar 15 stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

https://t.me/year2023start
https://steamcommunity.com/profiles/76561199467421923

Attributes

profile_id
15

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1160 set thread context of 1736	1160	Setup.exe	26

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1736	1160	Setup.exe	26
PID 1160 wrote to memory of 1736	1160	Setup.exe	26
PID 1160 wrote to memory of 1736	1160	Setup.exe	26
PID 1160 wrote to memory of 1736	1160	Setup.exe	26
PID 1160 wrote to memory of 1736	1160	Setup.exe	26
PID 1160 wrote to memory of 1736	1160	Setup.exe	26
PID 1160 wrote to memory of 1736	1160	Setup.exe	26
PID 1160 wrote to memory of 1736	1160	Setup.exe	26
PID 1160 wrote to memory of 1736	1160	Setup.exe	26
PID 1160 wrote to memory of 1736	1160	Setup.exe	26
PID 1160 wrote to memory of 1736	1160	Setup.exe	26
PID 1160 wrote to memory of 1736	1160	Setup.exe	26
PID 1160 wrote to memory of 1736	1160	Setup.exe	26

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1160-54-0x0000000000B30000-0x0000000000CCE000-memory.dmp

Download

memory/1160-55-0x000007FEFBB21000-0x000007FEFBB23000-memory.dmp

Download

memory/1160-56-0x0000000002350000-0x00000000023E0000-memory.dmp

Download

memory/1736-57-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/1736-60-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/1736-61-0x0000000000400000-0x0000000000461000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads