vidar | 4a58b53944c62843be5315fcf2556781e938ca6a0b82097186399a0fcecc1248

Analysis

Target

eufive_20211023-071837.exe
Size

766KB
MD5

407b55e8f7e2333e693d378bb04e015f
SHA1

df8ddcce350f0424444a51d830a244570188aa23
SHA256

4a58b53944c62843be5315fcf2556781e938ca6a0b82097186399a0fcecc1248
SHA512

e60fe00e67ec74c9c705a025e7136a5bc69dff72dff8548697cbb276a6164943218d0c763dd779a5eb060f33b14045015627c2ddd62b386587012e3b85a0fb25

Score

10^/10

vidar 865 stealer

Family

vidar

Version

41.5

Botnet

865

https://mas.to/@xeroxxx

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/652-56-0x00000000002F0000-0x00000000003C6000-memory.dmp	family_vidar
behavioral1/memory/652-57-0x0000000000400000-0x00000000008EF000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1164 652 WerFault.exe eufive_20211023-071837.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1164 WerFault.exe
1164 WerFault.exe
1164 WerFault.exe
1164 WerFault.exe
1164 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1164 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1164 WerFault.exe

pid	pid_target	process	target process
1164	652	WerFault.exe	eufive_20211023-071837.exe

pid	process
1164	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1164	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

eufive_20211023-071837.exe

description	pid	process	target process
PID 652 wrote to memory of 1164	652	eufive_20211023-071837.exe	WerFault.exe
PID 652 wrote to memory of 1164	652	eufive_20211023-071837.exe	WerFault.exe
PID 652 wrote to memory of 1164	652	eufive_20211023-071837.exe	WerFault.exe
PID 652 wrote to memory of 1164	652	eufive_20211023-071837.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\eufive_20211023-071837.exe
"C:\Users\Admin\AppData\Local\Temp\eufive_20211023-071837.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:652

memory/652-54-0x0000000000D49000-0x0000000000DC5000-memory.dmp

Filesize
496KB

Download
memory/652-55-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download
memory/652-56-0x00000000002F0000-0x00000000003C6000-memory.dmp

Filesize
856KB

Download
memory/652-57-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1164-58-0x0000000000000000-mapping.dmp

Download
memory/1164-59-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Filesize
384KB

Download