vidar | 2692f4594cebfa3afca882274dc1432fea1ccbc7d3f37db3e15059722db1d97b

Analysis

Target

a1d952bac582c5d5f44c6f0ff09ebedd.exe
Size

744KB
MD5

a1d952bac582c5d5f44c6f0ff09ebedd
SHA1

4dced96e35ea074c01e6bd4c5b8fc3c881c695e7
SHA256

2692f4594cebfa3afca882274dc1432fea1ccbc7d3f37db3e15059722db1d97b
SHA512

6bfc2f1ff5ded10c0dc355757fcca092b0388c9cce11e725cb5c77a0dae11ab1b004dd42b11d90d468cf09c23d1db5e70b9afc3112ebe1727b401af871516e48

Score

10^/10

vidar 1008 stealer

Family

vidar

Version

41.3

Botnet

1008

https://mas.to/@oleg98

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1368-56-0x0000000002F10000-0x0000000002FE6000-memory.dmp	family_vidar
behavioral1/memory/1368-57-0x0000000000400000-0x000000000172D000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1812 1368 WerFault.exe a1d952bac582c5d5f44c6f0ff09ebedd.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1812 WerFault.exe
1812 WerFault.exe
1812 WerFault.exe
1812 WerFault.exe
1812 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1812 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1812 WerFault.exe

pid	pid_target	process	target process
1812	1368	WerFault.exe	a1d952bac582c5d5f44c6f0ff09ebedd.exe

pid	process
1812	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1812	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a1d952bac582c5d5f44c6f0ff09ebedd.exe

description	pid	process	target process
PID 1368 wrote to memory of 1812	1368	a1d952bac582c5d5f44c6f0ff09ebedd.exe	WerFault.exe
PID 1368 wrote to memory of 1812	1368	a1d952bac582c5d5f44c6f0ff09ebedd.exe	WerFault.exe
PID 1368 wrote to memory of 1812	1368	a1d952bac582c5d5f44c6f0ff09ebedd.exe	WerFault.exe
PID 1368 wrote to memory of 1812	1368	a1d952bac582c5d5f44c6f0ff09ebedd.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a1d952bac582c5d5f44c6f0ff09ebedd.exe
"C:\Users\Admin\AppData\Local\Temp\a1d952bac582c5d5f44c6f0ff09ebedd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368

memory/1368-54-0x000000000030B000-0x0000000000388000-memory.dmp

Filesize
500KB

Download
memory/1368-55-0x00000000768C1000-0x00000000768C3000-memory.dmp

Filesize
8KB

Download
memory/1368-56-0x0000000002F10000-0x0000000002FE6000-memory.dmp

Filesize
856KB

Download
memory/1368-57-0x0000000000400000-0x000000000172D000-memory.dmp

Filesize
19.2MB

Download
memory/1812-58-0x0000000000000000-mapping.dmp

Download
memory/1812-59-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download