Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/08/2023, 09:48

General

  • Target

    a87497e2839d82f46e318368ec1ad62630f0720e64965be6b5c46bbf25ec6832.exe

  • Size

    313KB

  • MD5

    c08995efb1a85d0fe00a464efdf4c92c

  • SHA1

    5093dd4321b9a87dcda8153dc1cb77e0a6ee2541

  • SHA256

    a87497e2839d82f46e318368ec1ad62630f0720e64965be6b5c46bbf25ec6832

  • SHA512

    9b8744bfab8b3532cafadcfd5137934c2a1b016bf66c4ddb4ae88c70268cb7f5999e037143e378aa0584f55c2779fdba953305f616d17224a43aa375735f12d3

  • SSDEEP

    6144:1CXlEI98N3Lpfnq2tl7HF3Uf2ESMSb7gxioDYEkfMu2cwwE:1uaIuh4KhsioDkf8cDE

Malware Config

Extracted

Family

vidar

Version

2.8

Botnet

f3797ff2d6e4462d7a15aa7a59383f3e

C2

https://t.me/dionysus_tg

https://steamcommunity.com/profiles/76561199482248283

http://157.90.113.100:80

Attributes
  • profile_id_v2

    f3797ff2d6e4462d7a15aa7a59383f3e

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a87497e2839d82f46e318368ec1ad62630f0720e64965be6b5c46bbf25ec6832.exe
    "C:\Users\Admin\AppData\Local\Temp\a87497e2839d82f46e318368ec1ad62630f0720e64965be6b5c46bbf25ec6832.exe"
    1⤵
      PID:3172

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3172-134-0x0000000000760000-0x0000000000860000-memory.dmp

      Filesize

      1024KB

    • memory/3172-135-0x0000000002200000-0x000000000225C000-memory.dmp

      Filesize

      368KB

    • memory/3172-136-0x0000000000400000-0x0000000000591000-memory.dmp

      Filesize

      1.6MB

    • memory/3172-149-0x0000000000760000-0x0000000000860000-memory.dmp

      Filesize

      1024KB

    • memory/3172-150-0x0000000002200000-0x000000000225C000-memory.dmp

      Filesize

      368KB

    • memory/3172-151-0x0000000000400000-0x0000000000591000-memory.dmp

      Filesize

      1.6MB