vidar | 7ec5f24e6f59719e6c071ec719dcfcbe8e48f5293f493b903f19446c1815048b

Analysis

Target

0ce1142f9f77965a89851422bcbf840d.exe
Size

743KB
MD5

0ce1142f9f77965a89851422bcbf840d
SHA1

9550e44f366f9d405d0b41007174ee4ed78d4994
SHA256

7ec5f24e6f59719e6c071ec719dcfcbe8e48f5293f493b903f19446c1815048b
SHA512

ed34886a9752c422681d6e962b986e511a1a02e21f3a0030db296fe1769af36b61b706ccf441495f49779cd417d78e52bd8dbcfa53951545b07020f2e288b3d7

Score

10^/10

vidar 903 stealer

Family

vidar

Version

41.3

Botnet

903

https://mas.to/@oleg98

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1548-56-0x0000000000320000-0x00000000003F6000-memory.dmp	family_vidar
behavioral1/memory/1548-57-0x0000000000400000-0x000000000172D000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

396 1548 WerFault.exe 0ce1142f9f77965a89851422bcbf840d.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

396 WerFault.exe
396 WerFault.exe
396 WerFault.exe
396 WerFault.exe
396 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

396 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 396 WerFault.exe

pid	pid_target	process	target process
396	1548	WerFault.exe	0ce1142f9f77965a89851422bcbf840d.exe

pid	process
396	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	396	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0ce1142f9f77965a89851422bcbf840d.exe

description	pid	process	target process
PID 1548 wrote to memory of 396	1548	0ce1142f9f77965a89851422bcbf840d.exe	WerFault.exe
PID 1548 wrote to memory of 396	1548	0ce1142f9f77965a89851422bcbf840d.exe	WerFault.exe
PID 1548 wrote to memory of 396	1548	0ce1142f9f77965a89851422bcbf840d.exe	WerFault.exe
PID 1548 wrote to memory of 396	1548	0ce1142f9f77965a89851422bcbf840d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0ce1142f9f77965a89851422bcbf840d.exe
"C:\Users\Admin\AppData\Local\Temp\0ce1142f9f77965a89851422bcbf840d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1548

memory/396-58-0x0000000000000000-mapping.dmp

Download
memory/396-59-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/1548-54-0x00000000017DB000-0x0000000001857000-memory.dmp

Filesize
496KB

Download
memory/1548-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1548-56-0x0000000000320000-0x00000000003F6000-memory.dmp

Filesize
856KB

Download
memory/1548-57-0x0000000000400000-0x000000000172D000-memory.dmp

Filesize
19.2MB

Download