vidar | f8433d6f19db029e973b40f72ccc3f24d5b22a04b82d83c612db8976ab405d1c | Triage

Analysis

max time kernel
23s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2023 06:59

Sharing

Report Analysis Logs

General

Target

Setup.exe
Size

452.8MB
MD5

8038353251c3354dfb9449c95dacd6fa
SHA1

912625aa341a407a40f92f8cd187d4123f7c0988
SHA256

f8433d6f19db029e973b40f72ccc3f24d5b22a04b82d83c612db8976ab405d1c
SHA512

eab8f82ae234896c59b5b33d979632ef25fed8e41dbef337b8261840a910019ea1612984b697fba7787939e6fee677486eb6e1223f52b986effd41bad2c4f32a
SSDEEP

24576:RsSmmZsh68p+rXSdf5VsLddr9NV9zbdlKrfnIG2QOAWIcRKXhuDoFhBlQT:WHpASdxyLdH39PdgsGLcjoFhBlc

Score

10^/10

vidar stealer

Malware Config

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Setup.exe

description pid process

Token: SeIncBasePriorityPrivilege 1224 Setup.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-132-0x0000000000E60000-0x000000000110D000-memory.dmp

Filesize
2.7MB

Download
memory/1224-133-0x0000000000E60000-0x000000000110D000-memory.dmp

Filesize
2.7MB

Download
memory/1224-134-0x00000000027C0000-0x00000000029DE000-memory.dmp

Filesize
2.1MB

Download
memory/1224-135-0x00000000005B0000-0x00000000005B4000-memory.dmp

Filesize
16KB

Download