Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 14:19

General

  • Target

    c3ba328200ff6fa492d87e30674eba49236a4ea3c72db48943f086f8a618102b.exe

  • Size

    7.3MB

  • MD5

    e10eb4190253081880b3201dbe5fb87d

  • SHA1

    cc74ebf650bb3e85ebe3da9b73c4f036f2d35b3e

  • SHA256

    c3ba328200ff6fa492d87e30674eba49236a4ea3c72db48943f086f8a618102b

  • SHA512

    05123c281ec8d32cecebebe0e0be2c72c343a51d451d13ac55f4b96a14fdd7b52db443c7f5f5f9dcf7457e61e15a52cc0adf841de2170c3ad9b2d84a7555b13d

  • SSDEEP

    6144:8lPpeJsRFLq1VDYVrC3mPT/ptUQ8gD2Lc0oDf9sVuq1:8lEq/W19U+0ptlZqLHw1BW

Malware Config

Extracted

Family

vidar

Version

55.4

Botnet

977

C2

https://t.me/truemansho

https://mas.to/@jogifoy492

http://95.217.27.155:80

Attributes
  • profile_id

    977

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c3ba328200ff6fa492d87e30674eba49236a4ea3c72db48943f086f8a618102b.exe
    "C:\Users\Admin\AppData\Local\Temp\c3ba328200ff6fa492d87e30674eba49236a4ea3c72db48943f086f8a618102b.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4844-1-0x0000000000640000-0x0000000000740000-memory.dmp

    Filesize

    1024KB

  • memory/4844-2-0x00000000021F0000-0x0000000002249000-memory.dmp

    Filesize

    356KB

  • memory/4844-3-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/4844-19-0x0000000000640000-0x0000000000740000-memory.dmp

    Filesize

    1024KB

  • memory/4844-20-0x00000000021F0000-0x0000000002249000-memory.dmp

    Filesize

    356KB

  • memory/4844-21-0x0000000000400000-0x00000000005B4000-memory.dmp

    Filesize

    1.7MB

  • memory/4844-22-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB