Behavioral task
behavioral1
Sample
2124-370-0x0000000000400000-0x0000000000471000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2124-370-0x0000000000400000-0x0000000000471000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
2124-370-0x0000000000400000-0x0000000000471000-memory.dmp
-
Size
452KB
-
MD5
c16f454875656ebeb3f74f602093aabc
-
SHA1
b96c285bbc7a19b4128dbc5416e5efbeed7e3233
-
SHA256
28ce2e64cd87f0ee1b806bdb61eae0248c352146916eac6bb1b8e18685b09f2c
-
SHA512
9fc378505fddd31b5e6f1f71b32ddad59430fc33b88aab77a4d943796a1e99fb12292722f8bf293967f34ff7a2af912b98ee76d9204e52f7f64c10f0566bf153
-
SSDEEP
6144:7Vv/3min9NW2AzQTShI21g6BCW7zfmSazcn4v4FHwyCU5AxuX5KAl:Zv/33ntA8A1phKJcn4vAQysgnl
Malware Config
Extracted
vidar
2.9
694f12963bedb0c6040fb3c74aac71e5
https://t.me/nemesisgrow
https://steamcommunity.com/profiles/76561199471222742
http://65.109.12.165:80
-
profile_id_v2
694f12963bedb0c6040fb3c74aac71e5
Signatures
-
Vidar family
Files
-
2124-370-0x0000000000400000-0x0000000000471000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 269KB - Virtual size: 268KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ