vidar | 9cffbade290f88c34b8a5e2e551fd9ae035eeda9d49d0eb0fecec8e40ecf2e84

Analysis

Target

addc536bf186bf0f1f3c1bfb0dd10fb6.exe
Size

743KB
MD5

addc536bf186bf0f1f3c1bfb0dd10fb6
SHA1

30608904d812a48535427dff89ca28640477fb90
SHA256

9cffbade290f88c34b8a5e2e551fd9ae035eeda9d49d0eb0fecec8e40ecf2e84
SHA512

4fa4fd543f20103dc03690e192e251a19fdd4e79af31fbfa57cf9d68eb290412f9fa76c943bac95d6af9bd613e8efb492ad83094587720d68f8d4597cce61091

Score

10^/10

vidar 1008 stealer

Family

vidar

Version

41.3

Botnet

1008

https://mas.to/@oleg98

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2012-56-0x0000000002F90000-0x0000000003066000-memory.dmp	family_vidar
behavioral1/memory/2012-57-0x0000000000400000-0x000000000172D000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1480 2012 WerFault.exe addc536bf186bf0f1f3c1bfb0dd10fb6.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1480 WerFault.exe
1480 WerFault.exe
1480 WerFault.exe
1480 WerFault.exe
1480 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1480 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1480 WerFault.exe

pid	pid_target	process	target process
1480	2012	WerFault.exe	addc536bf186bf0f1f3c1bfb0dd10fb6.exe

pid	process
1480	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1480	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

addc536bf186bf0f1f3c1bfb0dd10fb6.exe

description	pid	process	target process
PID 2012 wrote to memory of 1480	2012	addc536bf186bf0f1f3c1bfb0dd10fb6.exe	WerFault.exe
PID 2012 wrote to memory of 1480	2012	addc536bf186bf0f1f3c1bfb0dd10fb6.exe	WerFault.exe
PID 2012 wrote to memory of 1480	2012	addc536bf186bf0f1f3c1bfb0dd10fb6.exe	WerFault.exe
PID 2012 wrote to memory of 1480	2012	addc536bf186bf0f1f3c1bfb0dd10fb6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\addc536bf186bf0f1f3c1bfb0dd10fb6.exe
"C:\Users\Admin\AppData\Local\Temp\addc536bf186bf0f1f3c1bfb0dd10fb6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012

memory/1480-58-0x0000000000000000-mapping.dmp

Download
memory/1480-59-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/2012-54-0x000000000030B000-0x0000000000388000-memory.dmp

Filesize
500KB

Download
memory/2012-55-0x0000000075FA1000-0x0000000075FA3000-memory.dmp

Filesize
8KB

Download
memory/2012-56-0x0000000002F90000-0x0000000003066000-memory.dmp

Filesize
856KB

Download
memory/2012-57-0x0000000000400000-0x000000000172D000-memory.dmp

Filesize
19.2MB

Download