vidar | b3dd1655ef724dd9429d64625a80474c3b5d74d5c1cc806e11be89435ac0cd5a

Analysis

Target

b3dd1655ef724dd9429d64625a80474c3b5d74d5c1cc806e11be89435ac0cd5a.exe
Size

772KB
MD5

c0c1c445b62bf70f0de2341e06eb3817
SHA1

a1cc41eda4ba9a1ffc018739a25548dd63bddfd0
SHA256

b3dd1655ef724dd9429d64625a80474c3b5d74d5c1cc806e11be89435ac0cd5a
SHA512

2c50aa38410c0d7668b4bea21e2018046328ca393a755522a86e895aea2511f062bcf123ce2cf8c2fef956f92e7d32dd1a37f9c21562e753e5f5d84c6e080f83

Score

10^/10

vidar 933 stealer

Family

vidar

Version

47.9

Botnet

933

https://mas.to/@kirpich

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/740-58-0x0000000002200000-0x00000000022D6000-memory.dmp	family_vidar
behavioral1/memory/740-59-0x0000000000400000-0x00000000004D9000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1480 740 WerFault.exe b3dd1655ef724dd9429d64625a80474c3b5d74d5c1cc806e11be89435ac0cd5a.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1480 WerFault.exe
1480 WerFault.exe
1480 WerFault.exe
1480 WerFault.exe
1480 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1480 WerFault.exe

pid	pid_target	process	target process
1480	740	WerFault.exe	b3dd1655ef724dd9429d64625a80474c3b5d74d5c1cc806e11be89435ac0cd5a.exe

description	pid	process
Token: SeDebugPrivilege	1480	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b3dd1655ef724dd9429d64625a80474c3b5d74d5c1cc806e11be89435ac0cd5a.exe

description	pid	process	target process
PID 740 wrote to memory of 1480	740	b3dd1655ef724dd9429d64625a80474c3b5d74d5c1cc806e11be89435ac0cd5a.exe	WerFault.exe
PID 740 wrote to memory of 1480	740	b3dd1655ef724dd9429d64625a80474c3b5d74d5c1cc806e11be89435ac0cd5a.exe	WerFault.exe
PID 740 wrote to memory of 1480	740	b3dd1655ef724dd9429d64625a80474c3b5d74d5c1cc806e11be89435ac0cd5a.exe	WerFault.exe
PID 740 wrote to memory of 1480	740	b3dd1655ef724dd9429d64625a80474c3b5d74d5c1cc806e11be89435ac0cd5a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b3dd1655ef724dd9429d64625a80474c3b5d74d5c1cc806e11be89435ac0cd5a.exe
"C:\Users\Admin\AppData\Local\Temp\b3dd1655ef724dd9429d64625a80474c3b5d74d5c1cc806e11be89435ac0cd5a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:740

memory/740-55-0x00000000002CD000-0x000000000034A000-memory.dmp

Filesize
500KB

Download
memory/740-56-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/740-57-0x00000000002CD000-0x000000000034A000-memory.dmp

Filesize
500KB

Download
memory/740-58-0x0000000002200000-0x00000000022D6000-memory.dmp

Filesize
856KB

Download
memory/740-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1480-60-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download