vidar | cba4bf2713f913043fd6aa5990aa937a470f48c11c3d0361fe1cb951d6a74c76

Analysis

Target

cba4bf2713f913043fd6aa5990aa937a470f48c11c3d0361fe1cb951d6a74c76.exe
Size

764KB
MD5

6803564f8d27498decae376b90142e4f
SHA1

41faef623fe7f6eaf120ac22d66e7c6fc1779db4
SHA256

cba4bf2713f913043fd6aa5990aa937a470f48c11c3d0361fe1cb951d6a74c76
SHA512

79b3e8eaa9539995738b281c842861f118e85449094ef8d8a7e5c4774bba1a3cfadc27fc88353b3411acbbef8780c7a0348545844d461e94751aed4ade8f3f29

Score

10^/10

vidar 937 stealer

Family

vidar

Version

48.2

Botnet

937

https://koyu.space/@qmashton

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/744-57-0x0000000004350000-0x0000000004425000-memory.dmp	family_vidar
behavioral1/memory/744-58-0x0000000000400000-0x00000000004D8000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

992 744 WerFault.exe cba4bf2713f913043fd6aa5990aa937a470f48c11c3d0361fe1cb951d6a74c76.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

992 WerFault.exe
992 WerFault.exe
992 WerFault.exe
992 WerFault.exe
992 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

992 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 992 WerFault.exe

pid	pid_target	process	target process
992	744	WerFault.exe	cba4bf2713f913043fd6aa5990aa937a470f48c11c3d0361fe1cb951d6a74c76.exe

pid	process
992	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	992	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cba4bf2713f913043fd6aa5990aa937a470f48c11c3d0361fe1cb951d6a74c76.exe

description	pid	process	target process
PID 744 wrote to memory of 992	744	cba4bf2713f913043fd6aa5990aa937a470f48c11c3d0361fe1cb951d6a74c76.exe	WerFault.exe
PID 744 wrote to memory of 992	744	cba4bf2713f913043fd6aa5990aa937a470f48c11c3d0361fe1cb951d6a74c76.exe	WerFault.exe
PID 744 wrote to memory of 992	744	cba4bf2713f913043fd6aa5990aa937a470f48c11c3d0361fe1cb951d6a74c76.exe	WerFault.exe
PID 744 wrote to memory of 992	744	cba4bf2713f913043fd6aa5990aa937a470f48c11c3d0361fe1cb951d6a74c76.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cba4bf2713f913043fd6aa5990aa937a470f48c11c3d0361fe1cb951d6a74c76.exe
"C:\Users\Admin\AppData\Local\Temp\cba4bf2713f913043fd6aa5990aa937a470f48c11c3d0361fe1cb951d6a74c76.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:744

memory/744-54-0x00000000002EB000-0x0000000000367000-memory.dmp

Filesize
496KB

Download
memory/744-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/744-56-0x00000000002EB000-0x0000000000367000-memory.dmp

Filesize
496KB

Download
memory/744-57-0x0000000004350000-0x0000000004425000-memory.dmp

Filesize
852KB

Download
memory/744-58-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/992-59-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download