Behavioral task
behavioral1
Sample
4628-272-0x0000000000400000-0x0000000000471000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
4628-272-0x0000000000400000-0x0000000000471000-memory.exe
Resource
win10v2004-20230221-en
General
-
Target
4628-272-0x0000000000400000-0x0000000000471000-memory.dmp
-
Size
452KB
-
MD5
7b3fd89cb7bb44c64f9f7c9492a8a79a
-
SHA1
2efe4713a5ed76e236aa5c997de96e85356665b4
-
SHA256
90cdd6199e0321f4ab4992ae1db96396bb8de40c3b85f7ae5fc9e169b70a3f98
-
SHA512
8f52b3cbef7745b52304b79f43e30a837858646258d23c7214668d299a98a748dcf010b3b4279f1313cbaa91e4963a33cbeb29d7891324693eac48fb6a31abe5
-
SSDEEP
6144:7Vv/3min9NW2AzQTShI21g6BCW7zfmSazcn4v4+HwyCU5AxuH5KAl:Zv/33ntA8A1phKJcn4vTQysUnl
Malware Config
Extracted
vidar
2.9
694f12963bedb0c6040fb3c74aac71e5
https://t.me/nemesisgrow
https://steamcommunity.com/profiles/76561199471222742
http://65.109.12.165:80
-
profile_id_v2
694f12963bedb0c6040fb3c74aac71e5
Signatures
-
Vidar family
Files
-
4628-272-0x0000000000400000-0x0000000000471000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 269KB - Virtual size: 268KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ