Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 26, 2024, 10:49 a.m.	Aug. 26, 2024, 10:53 a.m.

Size	10.9MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`a154607fdb9dc1990f91e19b7a983b5e`
SHA256	`657667f4b9ea378ee83ee6aa691bdfb71b3dbf0a320eafbec50b7d1324982aba`
CRC32	`E9307F2A`
ssdeep	`196608:MIKLimvkgOM4eZUSNir72C3SA3iXIHSUmhi8oqvoecSA6sH0ebyF6maT:npiA3i4l8tvsS1OC6FT`
PDB Path	ViDeoAutoR.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

66bdb58f78c9f_Vidar.exe "C:\Users\test22\AppData\Local\Temp\66bdb58f78c9f_Vidar.exe"
2552

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 26, 2024, 10:49 a.m.			0	0
IsDebuggerPresent Aug. 26, 2024, 10:49 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

ViDeoAutoR.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 26, 2024, 10:49 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sdata

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (36 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00930000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00630000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00292000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00811000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0029a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00812000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00818000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00819000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0081a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0081b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0081c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0081d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ae000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0081e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05f90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05f91000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05f9d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05f9e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00910000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c14000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05f9f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00970000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00acf400', u'virtual_address': u'0x00002000', u'entropy': 7.479813394073878, u'name': u'.text', u'virtual_size': u'0x00acf324'}

entropy

7.47981339407

description

A section with a high entropy has been found

entropy

0.991002283003

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 26, 2024, 10:49 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Terminates another process (10 events)

Time & API	Arguments	Status
NtTerminateProcess Aug. 26, 2024, 10:49 a.m.	status_code: 0xffffffff process_identifier: 2676 process_handle: 0x00000260
NtTerminateProcess Aug. 26, 2024, 10:49 a.m.	status_code: 0xffffffff process_identifier: 2676 process_handle: 0x00000260	1
NtTerminateProcess Aug. 26, 2024, 10:49 a.m.	status_code: 0xffffffff process_identifier: 2712 process_handle: 0x00000268
NtTerminateProcess Aug. 26, 2024, 10:49 a.m.	status_code: 0xffffffff process_identifier: 2712 process_handle: 0x00000268	1
NtTerminateProcess Aug. 26, 2024, 10:49 a.m.	status_code: 0xffffffff process_identifier: 2748 process_handle: 0x00000270
NtTerminateProcess Aug. 26, 2024, 10:49 a.m.	status_code: 0xffffffff process_identifier: 2748 process_handle: 0x00000270	1
NtTerminateProcess Aug. 26, 2024, 10:49 a.m.	status_code: 0xffffffff process_identifier: 2784 process_handle: 0x00000278
NtTerminateProcess Aug. 26, 2024, 10:49 a.m.	status_code: 0xffffffff process_identifier: 2784 process_handle: 0x00000278	1
NtTerminateProcess Aug. 26, 2024, 10:49 a.m.	status_code: 0xffffffff process_identifier: 2820 process_handle: 0x00000280
NtTerminateProcess Aug. 26, 2024, 10:49 a.m.	status_code: 0xffffffff process_identifier: 2820 process_handle: 0x00000280	1

One or more of the buffers contains an embedded PE file (3 events)

buffer	Buffer with sha1: 865191ed68631667907d33a3557941ac33da34d9
buffer	Buffer with sha1: be209556542ebedf802a046ec097d22e2ba76e2c
buffer	Buffer with sha1: 31a7833396d6c401cc0a673765206b383f82844c

Allocates execute permission to another process indicative of possible code injection (5 events)

Time & API	Arguments	Return
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2676 region_size: 7618560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000258	3221225496
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2712 region_size: 7618560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000025c	3221225496
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2748 region_size: 7618560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000264	3221225496
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2784 region_size: 7618560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000026c	3221225496
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2820 region_size: 7618560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000274	3221225496

Manipulates memory of a non-child process indicative of process injection (10 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 2552 manipulating memory of non-child process 2676
Process injection	Process 2552 manipulating memory of non-child process 2712
Process injection	Process 2552 manipulating memory of non-child process 2748
Process injection	Process 2552 manipulating memory of non-child process 2784
Process injection	Process 2552 manipulating memory of non-child process 2820
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2676 region_size: 7618560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000258	3221225496	0
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2712 region_size: 7618560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000025c	3221225496	0
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2748 region_size: 7618560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000264	3221225496	0
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2784 region_size: 7618560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000026c	3221225496	0
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2820 region_size: 7618560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000274	3221225496	0

Executed a process and injected code into it, probably while unpacking (22 events)

Time & API	Arguments	Status	Return
NtResumeThread Aug. 26, 2024, 10:49 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2552	1	0
NtResumeThread Aug. 26, 2024, 10:49 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2552	1	0
NtResumeThread Aug. 26, 2024, 10:49 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2552	1	0
NtResumeThread Aug. 26, 2024, 10:49 a.m.	thread_handle: 0x00000228 suspend_count: 1 process_identifier: 2552	1	0
NtGetContextThread Aug. 26, 2024, 10:49 a.m.	thread_handle: 0x000000e8	1	0
NtGetContextThread Aug. 26, 2024, 10:49 a.m.	thread_handle: 0x000000e8	1	0
NtResumeThread Aug. 26, 2024, 10:49 a.m.	thread_handle: 0x000000e8 suspend_count: 1 process_identifier: 2552	1	0
CreateProcessInternalW Aug. 26, 2024, 10:49 a.m.	thread_identifier: 2680 thread_handle: 0x00000254 process_identifier: 2676 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\66bdb58f78c9f_Vidar.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\66bdb58f78c9f_Vidar.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000258	1	1
NtGetContextThread Aug. 26, 2024, 10:49 a.m.	thread_handle: 0x00000254	1	0
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2676 region_size: 7618560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000258		3221225496
CreateProcessInternalW Aug. 26, 2024, 10:49 a.m.	thread_identifier: 2716 thread_handle: 0x00000260 process_identifier: 2712 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\66bdb58f78c9f_Vidar.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\66bdb58f78c9f_Vidar.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000025c	1	1
NtGetContextThread Aug. 26, 2024, 10:49 a.m.	thread_handle: 0x00000260	1	0
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2712 region_size: 7618560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000025c		3221225496
CreateProcessInternalW Aug. 26, 2024, 10:49 a.m.	thread_identifier: 2752 thread_handle: 0x00000268 process_identifier: 2748 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\66bdb58f78c9f_Vidar.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\66bdb58f78c9f_Vidar.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000264	1	1
NtGetContextThread Aug. 26, 2024, 10:49 a.m.	thread_handle: 0x00000268	1	0
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2748 region_size: 7618560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000264		3221225496
CreateProcessInternalW Aug. 26, 2024, 10:49 a.m.	thread_identifier: 2788 thread_handle: 0x00000270 process_identifier: 2784 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\66bdb58f78c9f_Vidar.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\66bdb58f78c9f_Vidar.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000026c	1	1
NtGetContextThread Aug. 26, 2024, 10:49 a.m.	thread_handle: 0x00000270	1	0
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2784 region_size: 7618560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000026c		3221225496
CreateProcessInternalW Aug. 26, 2024, 10:49 a.m.	thread_identifier: 2824 thread_handle: 0x00000278 process_identifier: 2820 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\66bdb58f78c9f_Vidar.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\66bdb58f78c9f_Vidar.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000274	1	1
NtGetContextThread Aug. 26, 2024, 10:49 a.m.	thread_handle: 0x00000278	1	0
NtAllocateVirtualMemory Aug. 26, 2024, 10:49 a.m.	process_identifier: 2820 region_size: 7618560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000274		3221225496

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Bkav	W32.AIDetectMalware.CS
ALYac	Trojan.GenericKD.73850199
VIPRE	Trojan.GenericKD.73850199
K7AntiVirus	Trojan ( 005b67241 )
BitDefender	Trojan.GenericKD.73850199
K7GW	Trojan ( 005b67241 )
Cybereason	malicious.fdb9dc
Arcabit	Trojan.Generic.D466DD57
BitDefenderTheta	Gen:NN.ZemsilCO.36812.@t2@aWxL@zb
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.ALRR
Avast	Win32:Malware-gen
ClamAV	Win.Packed.Malwarex-10033462-0
Kaspersky	HEUR:Trojan-PSW.MSIL.RisePro.gen
MicroWorld-eScan	Trojan.GenericKD.73850199
Rising	Trojan.Kryptik!8.8 (TFE:dGZlOg1kJIJ2IGrTIg)
Emsisoft	Trojan.GenericKD.73850199 (B)
F-Secure	Trojan.TR/AD.Nekark.jumgp
FireEye	Trojan.GenericKD.73850199
SentinelOne	Static AI - Malicious PE
Google	Detected
Avira	TR/AD.Nekark.jumgp
MAX	malware (ai score=82)
Antiy-AVL	Trojan/MSIL.Kryptik
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan-PSW.MSIL.RisePro.gen
GData	Win32.Malware.Injector.K0YAN6
Varist	W32/MSIL_Kryptik.LEN.gen!Eldorado
AhnLab-V3	Downloader/Win.Powershell.C5659744
McAfee	Artemis!A154607FDB9D
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Crypt.MSIL.Generic
Ikarus	Trojan.MSIL.Crypt
Fortinet	MSIL/Kryptik.ALRL!tr
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_60% (W)

66bdb58f78c9f_Vidar.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All