vidar | 18d00aa5277e0aa198dcc2a3bc8cee034cb5e9c808b8220fe46fd18acc5f3010

Analysis

Target

0x000500000001abb1-152.dat.exe
Size

674KB
MD5

e6904455750065e6351626c373eba2bb
SHA1

e2917ff943628d8e9a715c1fadf20688d3e6396e
SHA256

18d00aa5277e0aa198dcc2a3bc8cee034cb5e9c808b8220fe46fd18acc5f3010
SHA512

838d884ebabda35d4580d9cee1845115d93e5725a3d159a034364f5576baed4ccbf182a42892b8109779d22e52e11db8b57174c2babf7f3787fdf5933e9d3878

Score

10^/10

vidar 754 stealer

Family

vidar

Version

41.6

Botnet

754

https://mas.to/@lilocc

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/588-56-0x0000000004850000-0x0000000004926000-memory.dmp	family_vidar
behavioral1/memory/588-57-0x0000000000400000-0x0000000002F6F000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1052 588 WerFault.exe 0x000500000001abb1-152.dat.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1052 WerFault.exe
1052 WerFault.exe
1052 WerFault.exe
1052 WerFault.exe
1052 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1052 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1052 WerFault.exe

pid	pid_target	process	target process
1052	588	WerFault.exe	0x000500000001abb1-152.dat.exe

pid	process
1052	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1052	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0x000500000001abb1-152.dat.exe

description	pid	process	target process
PID 588 wrote to memory of 1052	588	0x000500000001abb1-152.dat.exe	WerFault.exe
PID 588 wrote to memory of 1052	588	0x000500000001abb1-152.dat.exe	WerFault.exe
PID 588 wrote to memory of 1052	588	0x000500000001abb1-152.dat.exe	WerFault.exe
PID 588 wrote to memory of 1052	588	0x000500000001abb1-152.dat.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0x000500000001abb1-152.dat.exe
"C:\Users\Admin\AppData\Local\Temp\0x000500000001abb1-152.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:588

memory/588-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/588-56-0x0000000004850000-0x0000000004926000-memory.dmp

Filesize
856KB

Download
memory/588-55-0x00000000002F0000-0x000000000036C000-memory.dmp

Filesize
496KB

Download
memory/588-57-0x0000000000400000-0x0000000002F6F000-memory.dmp

Filesize
43.4MB

Download
memory/1052-58-0x0000000000000000-mapping.dmp

Download
memory/1052-59-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download