vidar | 039319cf3944c2873517912d91bd02c48a634c36ef69acab04e54d1ce07685c1

Analysis

Target

271c8cd98ea973ac6f624d19208659fa.exe
Size

770KB
MD5

271c8cd98ea973ac6f624d19208659fa
SHA1

23f8fe53a722a3684dd81e652ce1612940041423
SHA256

039319cf3944c2873517912d91bd02c48a634c36ef69acab04e54d1ce07685c1
SHA512

df185d1934b12c6dc748caf83caec78d56a82067eb4f55912a7bd9953d44e58707396c8dc4812f770fcd2ec2fbf809c0dea0f77fb89f8d7e0353802a981a62ee

Score

10^/10

vidar 1008 stealer

Family

vidar

Version

41.2

Botnet

1008

https://mas.to/@serg4325

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2004-55-0x0000000001740000-0x0000000001816000-memory.dmp	family_vidar
behavioral1/memory/2004-56-0x0000000000400000-0x0000000001734000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1932 2004 WerFault.exe 271c8cd98ea973ac6f624d19208659fa.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1932 WerFault.exe
1932 WerFault.exe
1932 WerFault.exe
1932 WerFault.exe
1932 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1932 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1932 WerFault.exe

pid	pid_target	process	target process
1932	2004	WerFault.exe	271c8cd98ea973ac6f624d19208659fa.exe

pid	process
1932	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1932	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

271c8cd98ea973ac6f624d19208659fa.exe

description	pid	process	target process
PID 2004 wrote to memory of 1932	2004	271c8cd98ea973ac6f624d19208659fa.exe	WerFault.exe
PID 2004 wrote to memory of 1932	2004	271c8cd98ea973ac6f624d19208659fa.exe	WerFault.exe
PID 2004 wrote to memory of 1932	2004	271c8cd98ea973ac6f624d19208659fa.exe	WerFault.exe
PID 2004 wrote to memory of 1932	2004	271c8cd98ea973ac6f624d19208659fa.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\271c8cd98ea973ac6f624d19208659fa.exe
"C:\Users\Admin\AppData\Local\Temp\271c8cd98ea973ac6f624d19208659fa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

memory/1932-57-0x0000000000000000-mapping.dmp

Download
memory/1932-58-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2004-53-0x000000000187B000-0x00000000018F8000-memory.dmp

Filesize
500KB

Download
memory/2004-54-0x0000000075C11000-0x0000000075C13000-memory.dmp

Filesize
8KB

Download
memory/2004-55-0x0000000001740000-0x0000000001816000-memory.dmp

Filesize
856KB

Download
memory/2004-56-0x0000000000400000-0x0000000001734000-memory.dmp

Filesize
19.2MB

Download