vidar | cd76a354a02015517a2b50d75aa3b68dd0e3164adbb040f6317251016bc62b21

Resubmissions

20-03-2024 23:00

240320-2y4btadd85 10

15-03-2024 20:34

240315-zcmqtscf84 10

Analysis

max time kernel
574s
max time network
580s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-03-2024 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe
Size

455KB
MD5

ca4016d215c65d3c44fffa0c5ff31cbc
SHA1

38df050b14a8566e4a57706e91884fa7826779e7
SHA256

02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b
SHA512

cf16707bc4f35f1ebe33691c20f116181f4714ed6417ead9b88f656e4fa1e848dc042e02a6b4a5c280b8bba516b3253a5cfd4a557c62ab14ec5d47b107f1ad52
SSDEEP

12288:/GUT7l7g57eLmTgcH0GIsbU7i9f/jyarsT:/GUT7l7wamQGk7i9f/3rw

Score

10^/10

vidar 408 stealer

Malware Config

Extracted

Family

vidar

Version

2.5

Botnet

408

https://t.me/noktasina

https://steamcommunity.com/profiles/76561199478503353

http://95.217.152.87:80

Attributes

profile_id
408
user_agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.0.0 Safari/537.36

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4304 set thread context of 4812	4304	02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe	92

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 4812	4304	02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe	92
PID 4304 wrote to memory of 4812	4304	02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe	92
PID 4304 wrote to memory of 4812	4304	02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe	92
PID 4304 wrote to memory of 4812	4304	02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe	92
PID 4304 wrote to memory of 4812	4304	02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe	92

C:\Users\Admin\AppData\Local\Temp\02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe
"C:\Users\Admin\AppData\Local\Temp\02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4304-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download
memory/4812-2-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4812-8-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download