vidar | c0468d6d8f3a6ed63e2c6cfaa0d6b7bff7c959a611351954793e47d723bd9985

Analysis

Target

c0468d6d8f3a6ed63e2c6cfaa0d6b7bff7c959a611351954793e47d723bd9985.exe
Size

688KB
MD5

5716c79899c4b2f43e50fcf4e9eaefa0
SHA1

9bbc2ae9dd7ac947fa87b6a905670764f717920f
SHA256

c0468d6d8f3a6ed63e2c6cfaa0d6b7bff7c959a611351954793e47d723bd9985
SHA512

d87126a3fa0949946149b0d84f03e3fc408a923d0a257e7418ec03fcb02da6dcd4fd8bacc557272c083f915142b970065c144876476f65c561a90a6aa6b4f9c2

Score

10^/10

vidar 937 stealer

Family

vidar

Version

48.1

Botnet

937

https://koyu.space/@rspich

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1656-57-0x0000000000320000-0x00000000003F5000-memory.dmp	family_vidar
behavioral1/memory/1656-58-0x0000000000400000-0x00000000004D8000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

432 1656 WerFault.exe c0468d6d8f3a6ed63e2c6cfaa0d6b7bff7c959a611351954793e47d723bd9985.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

432 WerFault.exe
432 WerFault.exe
432 WerFault.exe
432 WerFault.exe
432 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 432 WerFault.exe

pid	pid_target	process	target process
432	1656	WerFault.exe	c0468d6d8f3a6ed63e2c6cfaa0d6b7bff7c959a611351954793e47d723bd9985.exe

description	pid	process
Token: SeDebugPrivilege	432	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c0468d6d8f3a6ed63e2c6cfaa0d6b7bff7c959a611351954793e47d723bd9985.exe

description	pid	process	target process
PID 1656 wrote to memory of 432	1656	c0468d6d8f3a6ed63e2c6cfaa0d6b7bff7c959a611351954793e47d723bd9985.exe	WerFault.exe
PID 1656 wrote to memory of 432	1656	c0468d6d8f3a6ed63e2c6cfaa0d6b7bff7c959a611351954793e47d723bd9985.exe	WerFault.exe
PID 1656 wrote to memory of 432	1656	c0468d6d8f3a6ed63e2c6cfaa0d6b7bff7c959a611351954793e47d723bd9985.exe	WerFault.exe
PID 1656 wrote to memory of 432	1656	c0468d6d8f3a6ed63e2c6cfaa0d6b7bff7c959a611351954793e47d723bd9985.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c0468d6d8f3a6ed63e2c6cfaa0d6b7bff7c959a611351954793e47d723bd9985.exe
"C:\Users\Admin\AppData\Local\Temp\c0468d6d8f3a6ed63e2c6cfaa0d6b7bff7c959a611351954793e47d723bd9985.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656

memory/432-59-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1656-55-0x0000000074EC1000-0x0000000074EC3000-memory.dmp

Filesize
8KB

Download
memory/1656-56-0x0000000000220000-0x000000000029B000-memory.dmp

Filesize
492KB

Download
memory/1656-57-0x0000000000320000-0x00000000003F5000-memory.dmp

Filesize
852KB

Download
memory/1656-58-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download