Analysis
-
max time kernel
9s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 22:33
Static task
static1
Behavioral task
behavioral1
Sample
1e90790e7d177d29fc32f926a419c534.exe
Resource
win7-20231129-en
General
-
Target
1e90790e7d177d29fc32f926a419c534.exe
-
Size
604KB
-
MD5
1e90790e7d177d29fc32f926a419c534
-
SHA1
25142c6b5243f09542d28ce75f42f8b1e337bf18
-
SHA256
859b840ac0113845859e79c66583996665f246ccc6f3ebfe419e2e07e8f515cc
-
SHA512
667f4c651debd720b8f4c534fd4690a9cc2ddbce98d7577285f6e42b88e71ba209433ad0dcb3dc7d34b79df7a59ad6d1e7c8602365b5501d85a235c3d84d4f6d
-
SSDEEP
12288:qb7JEYkQ7Mgtxi1RZQ+EspGqoKq1pGtmI0LOzBx4J39tBvMxpG/80DT+:AEYkQ8K+EspjqfGJ0LCj4V9tFMLGU0
Malware Config
Extracted
vidar
40.1
706
https://eduarroma.tumblr.com/
-
profile_id
706
Signatures
-
Vidar Stealer 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2212-2-0x0000000000290000-0x000000000032D000-memory.dmp family_vidar behavioral1/memory/2212-3-0x0000000000400000-0x0000000002400000-memory.dmp family_vidar behavioral1/memory/2212-43-0x0000000000400000-0x0000000002400000-memory.dmp family_vidar behavioral1/memory/2212-65-0x0000000000290000-0x000000000032D000-memory.dmp family_vidar -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3044 2212 WerFault.exe 1e90790e7d177d29fc32f926a419c534.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar2B69.tmpFilesize
84KB
MD5ece7150c2acdb783e5d2c06c811f5631
SHA157bd522da2fc53de8031a2eedcf53cfe3f874344
SHA256c609ddc356ad3775a8d4562e950186a78e65b7838358d75f23fb95c450bdee4b
SHA512a1759e2dc9494cdae9748d87d2ab8964d35063fb1555048bac77d83d82e43ff8d0342459e4f3668bac7ec7f0483ee93d981085098bb7dcdec2adaa26d4ed8843
-
memory/2212-2-0x0000000000290000-0x000000000032D000-memory.dmpFilesize
628KB
-
memory/2212-1-0x0000000002860000-0x0000000002960000-memory.dmpFilesize
1024KB
-
memory/2212-3-0x0000000000400000-0x0000000002400000-memory.dmpFilesize
32.0MB
-
memory/2212-43-0x0000000000400000-0x0000000002400000-memory.dmpFilesize
32.0MB
-
memory/2212-63-0x0000000002860000-0x0000000002960000-memory.dmpFilesize
1024KB
-
memory/2212-65-0x0000000000290000-0x000000000032D000-memory.dmpFilesize
628KB