vidar | d9b6823ca8e13b78c269c5d21e948dbab625ea87d3370d163eeabeb3822aef56

Analysis

Target

9ce7a85ba3d9b83cfe600c41859b1bd1.exe
Size

744KB
MD5

9ce7a85ba3d9b83cfe600c41859b1bd1
SHA1

bd1be91996a50af60298dbdb424f608e4f80a8d7
SHA256

d9b6823ca8e13b78c269c5d21e948dbab625ea87d3370d163eeabeb3822aef56
SHA512

7aad0065d6f748fe63777dcc1fa541d049aa55434eef5b67f0ec1110b63960bb3ee43ea16d6d03aecda4ac3ae794d623a7ac22802edfe61765695fd0e268816a

Score

10^/10

vidar 1008 stealer

Family

vidar

Version

41.3

Botnet

1008

https://mas.to/@oleg98

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1544-56-0x0000000000400000-0x000000000172D000-memory.dmp	family_vidar
behavioral1/memory/1544-55-0x0000000002F90000-0x0000000003066000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1692 1544 WerFault.exe 9ce7a85ba3d9b83cfe600c41859b1bd1.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1692 WerFault.exe
1692 WerFault.exe
1692 WerFault.exe
1692 WerFault.exe
1692 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1692 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1692 WerFault.exe

pid	pid_target	process	target process
1692	1544	WerFault.exe	9ce7a85ba3d9b83cfe600c41859b1bd1.exe

pid	process
1692	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1692	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9ce7a85ba3d9b83cfe600c41859b1bd1.exe

description	pid	process	target process
PID 1544 wrote to memory of 1692	1544	9ce7a85ba3d9b83cfe600c41859b1bd1.exe	WerFault.exe
PID 1544 wrote to memory of 1692	1544	9ce7a85ba3d9b83cfe600c41859b1bd1.exe	WerFault.exe
PID 1544 wrote to memory of 1692	1544	9ce7a85ba3d9b83cfe600c41859b1bd1.exe	WerFault.exe
PID 1544 wrote to memory of 1692	1544	9ce7a85ba3d9b83cfe600c41859b1bd1.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9ce7a85ba3d9b83cfe600c41859b1bd1.exe
"C:\Users\Admin\AppData\Local\Temp\9ce7a85ba3d9b83cfe600c41859b1bd1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544

memory/1544-53-0x000000000030B000-0x0000000000388000-memory.dmp

Filesize
500KB

Download
memory/1544-54-0x0000000074B91000-0x0000000074B93000-memory.dmp

Filesize
8KB

Download
memory/1544-56-0x0000000000400000-0x000000000172D000-memory.dmp

Filesize
19.2MB

Download
memory/1544-55-0x0000000002F90000-0x0000000003066000-memory.dmp

Filesize
856KB

Download
memory/1692-57-0x0000000000000000-mapping.dmp

Download
memory/1692-58-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download