vidar | 6cefcdfd1df7b64b7312d9d2d418a7f0e61c6b952c7f653d12db7e05a20089fd

Analysis

max time kernel
24s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05/06/2023, 17:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Route Maps.exe
Size 739.0MB
Sample230605-wgaehsaa32
SHA256 84bfaeb9b8dd2dc8b5828c44d9fe482892148911784f7ba04731fca73b7d7b93
MD5 8f0688799099cf910ab2682a05157353
SHA1 8f55bcaac0aea34e846116e0f0ec37ebee9a8850
SHA512 e5760d0b160a0da822ffe33274ad7d31c40c3e8a0a949c50556129626691b218658fde067fb567bbe839fa99dc81a3da46dc5d3deb97bc713387660678a586a5
SSDEEP 12288:rh4BoLish2RPws9dfVTaqd74vWgleSrMYFsUYp:GBoOOwwsAvdVrMYap
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar 875 stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

https://t.me/litlebey
https://steamcommunity.com/profiles/76561199472399815
http://157.90.148.112:80

Attributes

profile_id
875

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1740 set thread context of 1752	1740	Route Maps.exe	29

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1752	1740	Route Maps.exe	29
PID 1740 wrote to memory of 1752	1740	Route Maps.exe	29
PID 1740 wrote to memory of 1752	1740	Route Maps.exe	29
PID 1740 wrote to memory of 1752	1740	Route Maps.exe	29
PID 1740 wrote to memory of 1752	1740	Route Maps.exe	29
PID 1740 wrote to memory of 1752	1740	Route Maps.exe	29
PID 1740 wrote to memory of 1752	1740	Route Maps.exe	29
PID 1740 wrote to memory of 1752	1740	Route Maps.exe	29
PID 1740 wrote to memory of 1752	1740	Route Maps.exe	29
PID 1740 wrote to memory of 1752	1740	Route Maps.exe	29
PID 1740 wrote to memory of 1752	1740	Route Maps.exe	29
PID 1740 wrote to memory of 1752	1740	Route Maps.exe	29
PID 1740 wrote to memory of 1752	1740	Route Maps.exe	29

C:\Users\Admin\AppData\Local\Temp\Route Maps.exe
"C:\Users\Admin\AppData\Local\Temp\Route Maps.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-54-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/1752-56-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/1752-57-0x0000000000400000-0x000000000046C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads