vidar | 611796a36903059a2d1725d7849a375b9aa2902254c0d5f5fa2122e83570ea3a

Analysis

Target

ba1db6e8623f5d616b06bc749b21b6e0.exe
Size

742KB
MD5

ba1db6e8623f5d616b06bc749b21b6e0
SHA1

784b43d378764435fb0b334662d2be8ef71dac07
SHA256

611796a36903059a2d1725d7849a375b9aa2902254c0d5f5fa2122e83570ea3a
SHA512

9fff1d772d9799e833020aa2063e7652795bb077f50b3d18ae49fb1a0c88a800d500f38bb72161dba9a9918ec90757868fd2715cd6e318607ad7efc58d0f8dd9

Score

10^/10

vidar 1008 stealer

Family

vidar

Version

41.3

Botnet

1008

https://mas.to/@oleg98

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1092-56-0x00000000002F0000-0x00000000003C6000-memory.dmp	family_vidar
behavioral1/memory/1092-57-0x0000000000400000-0x000000000172D000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1492 1092 WerFault.exe ba1db6e8623f5d616b06bc749b21b6e0.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1492 WerFault.exe
1492 WerFault.exe
1492 WerFault.exe
1492 WerFault.exe
1492 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1492 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1492 WerFault.exe

pid	pid_target	process	target process
1492	1092	WerFault.exe	ba1db6e8623f5d616b06bc749b21b6e0.exe

pid	process
1492	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1492	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ba1db6e8623f5d616b06bc749b21b6e0.exe

description	pid	process	target process
PID 1092 wrote to memory of 1492	1092	ba1db6e8623f5d616b06bc749b21b6e0.exe	WerFault.exe
PID 1092 wrote to memory of 1492	1092	ba1db6e8623f5d616b06bc749b21b6e0.exe	WerFault.exe
PID 1092 wrote to memory of 1492	1092	ba1db6e8623f5d616b06bc749b21b6e0.exe	WerFault.exe
PID 1092 wrote to memory of 1492	1092	ba1db6e8623f5d616b06bc749b21b6e0.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ba1db6e8623f5d616b06bc749b21b6e0.exe
"C:\Users\Admin\AppData\Local\Temp\ba1db6e8623f5d616b06bc749b21b6e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092

memory/1092-54-0x000000000180B000-0x0000000001887000-memory.dmp

Filesize
496KB

Download
memory/1092-55-0x0000000074B41000-0x0000000074B43000-memory.dmp

Filesize
8KB

Download
memory/1092-56-0x00000000002F0000-0x00000000003C6000-memory.dmp

Filesize
856KB

Download
memory/1092-57-0x0000000000400000-0x000000000172D000-memory.dmp

Filesize
19.2MB

Download
memory/1492-58-0x0000000000000000-mapping.dmp

Download
memory/1492-59-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download