vidar | ce242ead59347522c60dfafc0b258a08449328691cf3742bc0a6fab5be9ba9d9

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-01-2023 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

368KB
MD5

72a188543585bf92a5d27d7d96577930
SHA1

883a046e79a4329cc05f904b82e270b0e31b96e6
SHA256

ce242ead59347522c60dfafc0b258a08449328691cf3742bc0a6fab5be9ba9d9
SHA512

260d76cf99ac63493e39b46e481d8783211fe15ddf1ca8689bcf80d60ce45fe870f81a33d5d64a8884ad5c9d3269cbe77faf721cb1f6381faf031949bc1610d6
SSDEEP

6144:Owz57pOFlpDofcQdKU8CvGJlcWwoKHL4YZUoWt6:Owz5UpMKbgWw5HcY

Score

10^/10

vidar 813 stealer

Malware Config

Extracted

Family

vidar

Version

1.8

Botnet

813

https://t.me/year2023start

https://steamcommunity.com/profiles/76561199467421923

Attributes

profile_id
813

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 856 set thread context of 996 856 file.exe AppLaunch.exe

description	pid	process	target process
PID 856 set thread context of 996	856	file.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

file.exe

description	pid	process	target process
PID 856 wrote to memory of 996	856	file.exe	AppLaunch.exe
PID 856 wrote to memory of 996	856	file.exe	AppLaunch.exe
PID 856 wrote to memory of 996	856	file.exe	AppLaunch.exe
PID 856 wrote to memory of 996	856	file.exe	AppLaunch.exe
PID 856 wrote to memory of 996	856	file.exe	AppLaunch.exe
PID 856 wrote to memory of 996	856	file.exe	AppLaunch.exe
PID 856 wrote to memory of 996	856	file.exe	AppLaunch.exe
PID 856 wrote to memory of 996	856	file.exe	AppLaunch.exe
PID 856 wrote to memory of 996	856	file.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:996

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/996-54-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/996-56-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/996-62-0x0000000000421BEC-mapping.dmp

Download
memory/996-63-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/996-64-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/996-65-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download