vidar | bd7eec533b670d12046211475971ef6d32b54c37290f41ba33a4cc6b09a925a4

Analysis

Target

bd7eec533b670d12046211475971ef6d32b54c37290f41ba33a4cc6b09a925a4.exe
Size

679KB
MD5

f4a9c73c92501f4ada0ad74830610e11
SHA1

f5755ba5404a3fc467f850ff2dd01e6d9fd228fd
SHA256

bd7eec533b670d12046211475971ef6d32b54c37290f41ba33a4cc6b09a925a4
SHA512

7eb7d62d729b2d2dbacd89d6f2a3d94f053ee0336a413fef76effd3a6b445e9f0877c931bfda11ac3624a0bb8ce09268fac4fb637b7d0ea128342a3d9ac80d7c

Score

10^/10

vidar 937 stealer

Family

vidar

Version

48.4

Botnet

937

https://koyu.space/@qmashton

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1916-56-0x00000000004E0000-0x00000000005B5000-memory.dmp	family_vidar
behavioral1/memory/1916-57-0x0000000000400000-0x00000000004D8000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1528 1916 WerFault.exe bd7eec533b670d12046211475971ef6d32b54c37290f41ba33a4cc6b09a925a4.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1528 WerFault.exe
1528 WerFault.exe
1528 WerFault.exe
1528 WerFault.exe
1528 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1528 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1528 WerFault.exe

pid	pid_target	process	target process
1528	1916	WerFault.exe	bd7eec533b670d12046211475971ef6d32b54c37290f41ba33a4cc6b09a925a4.exe

pid	process
1528	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1528	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bd7eec533b670d12046211475971ef6d32b54c37290f41ba33a4cc6b09a925a4.exe

description	pid	process	target process
PID 1916 wrote to memory of 1528	1916	bd7eec533b670d12046211475971ef6d32b54c37290f41ba33a4cc6b09a925a4.exe	WerFault.exe
PID 1916 wrote to memory of 1528	1916	bd7eec533b670d12046211475971ef6d32b54c37290f41ba33a4cc6b09a925a4.exe	WerFault.exe
PID 1916 wrote to memory of 1528	1916	bd7eec533b670d12046211475971ef6d32b54c37290f41ba33a4cc6b09a925a4.exe	WerFault.exe
PID 1916 wrote to memory of 1528	1916	bd7eec533b670d12046211475971ef6d32b54c37290f41ba33a4cc6b09a925a4.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bd7eec533b670d12046211475971ef6d32b54c37290f41ba33a4cc6b09a925a4.exe
"C:\Users\Admin\AppData\Local\Temp\bd7eec533b670d12046211475971ef6d32b54c37290f41ba33a4cc6b09a925a4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916

memory/1528-58-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1916-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1916-55-0x0000000000290000-0x000000000030B000-memory.dmp

Filesize
492KB

Download
memory/1916-56-0x00000000004E0000-0x00000000005B5000-memory.dmp

Filesize
852KB

Download
memory/1916-57-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download