vidar | 0548b90912c147102750c6b6e84504fa8f37f7143c288131a6e00793646024bc

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 13:49

Target

#Vidar/Setup.exe
Size

7.3MB
MD5

49b6bce6cd0111433969c39a62635f91
SHA1

0e34b4e770cc7d018b955bc14dabb205321e872c
SHA256

29345d9c6ff0106c9032b15e2c88f17bc8972ed843d1b5c044cf17d00f1d45c5
SHA512

4737663a5a6b30779650dcaa461b7751bfb735d2c906d04d877604db5a270f68205e0ff1240f2509f2835d885708b849759b10d22deff3bf0f03579bd1402ff8
SSDEEP

49152:/Ph7SQtfhuOhfEPOBjP9P6SOgjha5VKnRt3RQ9Wpvgt4sbVpEmVT1oG3vTROBYxI:ntBbz3q9QluER

Score

10^/10

Family

vidar

Botnet

9e23613691aee9405b5fb64671c7c70e

https://pvasms.top

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok

Attributes

profile_id_v2
9e23613691aee9405b5fb64671c7c70e
user_agent
Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/8.0.500.0 Safari/534.6

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral3/memory/2516-16-0x00000000005C0000-0x0000000000D07000-memory.dmp	family_vidar_v7
behavioral3/memory/2516-18-0x00000000005C0000-0x0000000000D07000-memory.dmp	family_vidar_v7

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1836 set thread context of 2644	1836	Setup.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2520	2516	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1836	Setup.exe
2644	cmd.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 2644	1836	Setup.exe	28
PID 1836 wrote to memory of 2644	1836	Setup.exe	28
PID 1836 wrote to memory of 2644	1836	Setup.exe	28
PID 1836 wrote to memory of 2644	1836	Setup.exe	28
PID 1836 wrote to memory of 2644	1836	Setup.exe	28
PID 2644 wrote to memory of 2516	2644	cmd.exe	30
PID 2644 wrote to memory of 2516	2644	cmd.exe	30
PID 2644 wrote to memory of 2516	2644	cmd.exe	30
PID 2644 wrote to memory of 2516	2644	cmd.exe	30
PID 2644 wrote to memory of 2516	2644	cmd.exe	30
PID 2644 wrote to memory of 2516	2644	cmd.exe	30
PID 2516 wrote to memory of 2520	2516	explorer.exe	31
PID 2516 wrote to memory of 2520	2516	explorer.exe	31
PID 2516 wrote to memory of 2520	2516	explorer.exe	31
PID 2516 wrote to memory of 2520	2516	explorer.exe	31

C:\Users\Admin\AppData\Local\Temp\97371866

Filesize
5.1MB

MD5
8f466a8d5e813597432b699f92056c3b

SHA1
7aed80bbf1f3648f81864923f336778be3aa549d

SHA256
62dd261523ccaa0697c6d67a3b8798b1ef5cd2089164fa7e01c18df13c8e5f0b

SHA512
a0bc866d6ada56f600479142736688d5c0dea68af9c7c68c3e5b139322f354b540c65a372fc1c538b976279d228779da21085608947903299cffec5f1bd61b8f

Download Submit
memory/1836-0-0x000007FEF5F30000-0x000007FEF6088000-memory.dmp

Filesize
1.3MB

Download
memory/1836-4-0x000007FEF5F30000-0x000007FEF6088000-memory.dmp

Filesize
1.3MB

Download
memory/1836-5-0x000007FEF5F30000-0x000007FEF6088000-memory.dmp

Filesize
1.3MB

Download
memory/1836-7-0x0000000000400000-0x0000000000B62000-memory.dmp

Filesize
7.4MB

Download
memory/2516-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2516-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2516-16-0x00000000005C0000-0x0000000000D07000-memory.dmp

Filesize
7.3MB

Download
memory/2516-18-0x00000000005C0000-0x0000000000D07000-memory.dmp

Filesize
7.3MB

Download
memory/2644-10-0x0000000074B10000-0x0000000074C84000-memory.dmp

Filesize
1.5MB

Download
memory/2644-11-0x0000000074B10000-0x0000000074C84000-memory.dmp

Filesize
1.5MB

Download
memory/2644-9-0x00000000772D0000-0x0000000077479000-memory.dmp

Filesize
1.7MB

Download
memory/2644-15-0x0000000074B10000-0x0000000074C84000-memory.dmp

Filesize
1.5MB

Download