Analysis
-
max time kernel
152s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2023 14:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
24dcc40f409b865b36d43192bb9af2c9.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
24dcc40f409b865b36d43192bb9af2c9.exe
-
Size
654KB
-
MD5
24dcc40f409b865b36d43192bb9af2c9
-
SHA1
320d4f5f3f0aae6ef25fefa0cb51a36c919fb825
-
SHA256
7e14fd83ee520cb29e0fdaa9bb674b42c14cf4b6edfd722fee49b45d08955586
-
SHA512
36ea236fd0203517c065d88a2bda6f83026f100ae530ea042517e1402126ac4367ab59bb67be433a64df5545b7798f77c6560380c7b383d62cb4bc777f235a88
-
SSDEEP
12288:uhSj1glvZZGFcIb6JTrWWe6+s/T0YkbgJX7LaPsAudCaQe42/ROt:3glvZS6pWD6+AVk4LwpcCv2/ROt
Malware Config
Extracted
Family
vidar
Version
39.7
Botnet
818
C2
https://shpak125.tumblr.com/
Attributes
-
profile_id
818
Signatures
-
Vidar Stealer 4 IoCs
Processes:
resource yara_rule behavioral2/memory/528-2-0x0000000002200000-0x000000000229D000-memory.dmp family_vidar behavioral2/memory/528-3-0x0000000000400000-0x00000000004BF000-memory.dmp family_vidar behavioral2/memory/528-13-0x0000000000400000-0x00000000004BF000-memory.dmp family_vidar behavioral2/memory/528-16-0x0000000002200000-0x000000000229D000-memory.dmp family_vidar
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/528-1-0x00000000004F0000-0x00000000005F0000-memory.dmpFilesize
1024KB
-
memory/528-2-0x0000000002200000-0x000000000229D000-memory.dmpFilesize
628KB
-
memory/528-3-0x0000000000400000-0x00000000004BF000-memory.dmpFilesize
764KB
-
memory/528-13-0x0000000000400000-0x00000000004BF000-memory.dmpFilesize
764KB
-
memory/528-14-0x00000000004F0000-0x00000000005F0000-memory.dmpFilesize
1024KB
-
memory/528-16-0x0000000002200000-0x000000000229D000-memory.dmpFilesize
628KB