Analysis

  • max time kernel
    26s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    15/01/2023, 17:11

General

  • Target

    infected/Setup x64.exe

  • Size

    331.8MB

  • MD5

    4210316bf41a99563cca90927f82244d

  • SHA1

    fe76eba47cb59bbc8a45dd6e856d729e578081da

  • SHA256

    0c7e2b060922788050b2af5250a8ebd462f9d52bdfd6ed6e9cf3a7a80420f12a

  • SHA512

    db43e3f85856c7b7de9fd99526637a3e5fc07ab34b52426538c4fc1aae780db6039c7ef14b50c9cbcd48e9e544250408d71183c9272f3b088e4e4cc21db2f6bb

  • SSDEEP

    196608:Hajex6RtY/8gpeV8gULTfHjZUtuggWAezYpT:hg8gULTfDONgWAezYp

Score
10/10

Malware Config

Extracted

Family

vidar

Version

1.8

Botnet

814

C2

https://t.me/year2023start

https://steamcommunity.com/profiles/76561199467421923

Attributes
  • profile_id

    814

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\infected\Setup x64.exe
    "C:\Users\Admin\AppData\Local\Temp\infected\Setup x64.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1800
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe"
      2⤵
        PID:296

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/296-56-0x0000000000400000-0x0000000000460000-memory.dmp

            Filesize

            384KB

          • memory/296-57-0x0000000000400000-0x0000000000460000-memory.dmp

            Filesize

            384KB

          • memory/296-59-0x0000000000400000-0x0000000000460000-memory.dmp

            Filesize

            384KB

          • memory/296-61-0x0000000000400000-0x0000000000460000-memory.dmp

            Filesize

            384KB

          • memory/296-63-0x0000000000400000-0x0000000000460000-memory.dmp

            Filesize

            384KB

          • memory/296-65-0x0000000000400000-0x0000000000460000-memory.dmp

            Filesize

            384KB

          • memory/296-68-0x0000000000400000-0x0000000000460000-memory.dmp

            Filesize

            384KB

          • memory/296-69-0x0000000000400000-0x0000000000460000-memory.dmp

            Filesize

            384KB

          • memory/1800-54-0x0000000000CB0000-0x000000000171E000-memory.dmp

            Filesize

            10.4MB

          • memory/1800-55-0x000000001C240000-0x000000001C49E000-memory.dmp

            Filesize

            2.4MB