vidar | 1fbbaa6cfa20d6e11a3e5e4ba0702f608d474cbf5a86eef891fb57a671c684be

Analysis

Target

bc8f0bfb94d9a4455282bb072b79e858.exe
Size

683KB
MD5

bc8f0bfb94d9a4455282bb072b79e858
SHA1

bb004397b82ba101f65a6aa9e8c7533061c01e2b
SHA256

1fbbaa6cfa20d6e11a3e5e4ba0702f608d474cbf5a86eef891fb57a671c684be
SHA512

60a40427f9011abc97e48dace42c8b0d9f39b1416e0d8dd27bab1110d99248fb8e273bd4218b8427bf6a4525c6d157b021703e43d5c5473d95f26f6e7d5ef1ad

Score

10^/10

vidar 1008 stealer

Family

vidar

Version

41.3

Botnet

1008

https://mas.to/@oleg98

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1596-57-0x0000000000400000-0x00000000004D9000-memory.dmp	family_vidar
behavioral1/memory/1596-56-0x0000000000550000-0x0000000000626000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

300 1596 WerFault.exe bc8f0bfb94d9a4455282bb072b79e858.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

300 WerFault.exe
300 WerFault.exe
300 WerFault.exe
300 WerFault.exe
300 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

300 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 300 WerFault.exe

pid	pid_target	process	target process
300	1596	WerFault.exe	bc8f0bfb94d9a4455282bb072b79e858.exe

pid	process
300	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	300	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bc8f0bfb94d9a4455282bb072b79e858.exe

description	pid	process	target process
PID 1596 wrote to memory of 300	1596	bc8f0bfb94d9a4455282bb072b79e858.exe	WerFault.exe
PID 1596 wrote to memory of 300	1596	bc8f0bfb94d9a4455282bb072b79e858.exe	WerFault.exe
PID 1596 wrote to memory of 300	1596	bc8f0bfb94d9a4455282bb072b79e858.exe	WerFault.exe
PID 1596 wrote to memory of 300	1596	bc8f0bfb94d9a4455282bb072b79e858.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bc8f0bfb94d9a4455282bb072b79e858.exe
"C:\Users\Admin\AppData\Local\Temp\bc8f0bfb94d9a4455282bb072b79e858.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1596

memory/300-58-0x0000000000000000-mapping.dmp

Download
memory/300-59-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/1596-54-0x00000000002C8000-0x0000000000345000-memory.dmp

Filesize
500KB

Download
memory/1596-55-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download
memory/1596-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1596-56-0x0000000000550000-0x0000000000626000-memory.dmp

Filesize
856KB

Download