vidar | 62643c81c3befc120dec30cdd367717e3bbb8a0d6bffff236bb2dab3a4aac5eb

Analysis

max time kernel
46s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/01/2023, 17:07

Target

Setup.exe
Size

449.9MB
MD5

ddc753cccdce3b98da63ab2142a35dc4
SHA1

677287e16783b832066af3e5ccb041fc1c10e5cd
SHA256

2167ad38a496b64205581da4196c631a7a9638ab2620e4d194a657b50744744f
SHA512

a041b18441959ce0683122a98e93cd3f44765481d6c1cae04eb1fdf6a6ee01d50ff108ceede51d764f10bf1f3babf957f72bcb8d03eecf29f420c487ed139f66
SSDEEP

24576:6Hx3QTYY7yzG2QvLUWWIFPZHK6urkquaWNXPWFSSjDjU:6RA/qavLRPZHi4PWkAI

Score

10^/10

vidar 586 stealer

Family

vidar

Version

1.8

Botnet

586

https://t.me/year2023start

https://steamcommunity.com/profiles/76561199467421923

Attributes

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2004 set thread context of 848	2004	Setup.exe	28

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 848	2004	Setup.exe	28
PID 2004 wrote to memory of 848	2004	Setup.exe	28
PID 2004 wrote to memory of 848	2004	Setup.exe	28
PID 2004 wrote to memory of 848	2004	Setup.exe	28
PID 2004 wrote to memory of 848	2004	Setup.exe	28
PID 2004 wrote to memory of 848	2004	Setup.exe	28
PID 2004 wrote to memory of 848	2004	Setup.exe	28
PID 2004 wrote to memory of 848	2004	Setup.exe	28
PID 2004 wrote to memory of 848	2004	Setup.exe	28
PID 2004 wrote to memory of 848	2004	Setup.exe	28
PID 2004 wrote to memory of 848	2004	Setup.exe	28
PID 2004 wrote to memory of 848	2004	Setup.exe	28
PID 2004 wrote to memory of 848	2004	Setup.exe	28

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  PID:848

memory/848-65-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/848-61-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/848-74-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/848-72-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/848-69-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/848-63-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/848-67-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/848-60-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2004-54-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/2004-55-0x0000000000080000-0x000000000017C000-memory.dmp

Filesize
1008KB

Download
memory/2004-59-0x0000000002400000-0x0000000002458000-memory.dmp

Filesize
352KB

Download
memory/2004-58-0x00000000052E0000-0x0000000005370000-memory.dmp

Filesize
576KB

Download
memory/2004-57-0x0000000000610000-0x000000000061A000-memory.dmp

Filesize
40KB

Download
memory/2004-56-0x00000000005B0000-0x00000000005C6000-memory.dmp

Filesize
88KB

Download