vidar | e19e5702b706ca6a9508d67a44379aaef9361111dcdcd99c65fac6e027534fa7

Analysis

Target

e19e5702b706ca6a9508d67a44379aaef9361111dcdcd99c65fac6e027534fa7.exe
Size

721KB
MD5

5aae43957aac87119b0c3b3f75238f5f
SHA1

6c3d927fb44f0afab6b8ab0130e47ba0b143f8b6
SHA256

e19e5702b706ca6a9508d67a44379aaef9361111dcdcd99c65fac6e027534fa7
SHA512

29775313ba24ce6c79f7f35ff3e71664211fea86887947307774bf9113acd6a0bbe2c69f86bf379cf6aac41746098e9002e77aaf61983157088e48528979ff34

Score

10^/10

vidar 937 stealer

Family

vidar

Version

47.8

Botnet

937

https://mas.to/@romashkin

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1928-58-0x0000000000960000-0x0000000000A36000-memory.dmp	family_vidar
behavioral1/memory/1928-59-0x0000000000400000-0x00000000004D9000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

804 1928 WerFault.exe e19e5702b706ca6a9508d67a44379aaef9361111dcdcd99c65fac6e027534fa7.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

804 WerFault.exe
804 WerFault.exe
804 WerFault.exe
804 WerFault.exe
804 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

804 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 804 WerFault.exe

pid	pid_target	process	target process
804	1928	WerFault.exe	e19e5702b706ca6a9508d67a44379aaef9361111dcdcd99c65fac6e027534fa7.exe

pid	process
804	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	804	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e19e5702b706ca6a9508d67a44379aaef9361111dcdcd99c65fac6e027534fa7.exe

description	pid	process	target process
PID 1928 wrote to memory of 804	1928	e19e5702b706ca6a9508d67a44379aaef9361111dcdcd99c65fac6e027534fa7.exe	WerFault.exe
PID 1928 wrote to memory of 804	1928	e19e5702b706ca6a9508d67a44379aaef9361111dcdcd99c65fac6e027534fa7.exe	WerFault.exe
PID 1928 wrote to memory of 804	1928	e19e5702b706ca6a9508d67a44379aaef9361111dcdcd99c65fac6e027534fa7.exe	WerFault.exe
PID 1928 wrote to memory of 804	1928	e19e5702b706ca6a9508d67a44379aaef9361111dcdcd99c65fac6e027534fa7.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e19e5702b706ca6a9508d67a44379aaef9361111dcdcd99c65fac6e027534fa7.exe
"C:\Users\Admin\AppData\Local\Temp\e19e5702b706ca6a9508d67a44379aaef9361111dcdcd99c65fac6e027534fa7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928

memory/804-60-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1928-55-0x0000000000AED000-0x0000000000B6A000-memory.dmp

Filesize
500KB

Download
memory/1928-56-0x0000000076511000-0x0000000076513000-memory.dmp

Filesize
8KB

Download
memory/1928-57-0x0000000000AED000-0x0000000000B6A000-memory.dmp

Filesize
500KB

Download
memory/1928-58-0x0000000000960000-0x0000000000A36000-memory.dmp

Filesize
856KB

Download
memory/1928-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download