vidar | 7e55bdeff8cc2a3cb72cf193e3dac16cfaef2a3019f43bed1f115472b2b44849

Analysis

Target

7e55bdeff8cc2a3cb72cf193e3dac16cfaef2a3019f43bed1f115472b2b44849.exe
Size

718KB
MD5

b40c5ec4c898518b42a7260e41932f03
SHA1

a91d15055fd02f373916d30895c878140b03ba4c
SHA256

7e55bdeff8cc2a3cb72cf193e3dac16cfaef2a3019f43bed1f115472b2b44849
SHA512

16dffd3cac18abc5194e3d5b5d43005c64fe157e687a8bcaf9011842b66a8de7f6fffe60fda883d25559ef04c07b51dff5fd9fa2a949526245a870f074638164

Score

10^/10

vidar 937 stealer

Family

vidar

Version

48.1

Botnet

937

https://koyu.space/@rspich

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1928-57-0x0000000002BB0000-0x0000000002C85000-memory.dmp	family_vidar
behavioral1/memory/1928-58-0x0000000000400000-0x00000000004D8000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1324 1928 WerFault.exe 7e55bdeff8cc2a3cb72cf193e3dac16cfaef2a3019f43bed1f115472b2b44849.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1324 WerFault.exe
1324 WerFault.exe
1324 WerFault.exe
1324 WerFault.exe
1324 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1324 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1324 WerFault.exe

pid	pid_target	process	target process
1324	1928	WerFault.exe	7e55bdeff8cc2a3cb72cf193e3dac16cfaef2a3019f43bed1f115472b2b44849.exe

pid	process
1324	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1324	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7e55bdeff8cc2a3cb72cf193e3dac16cfaef2a3019f43bed1f115472b2b44849.exe

description	pid	process	target process
PID 1928 wrote to memory of 1324	1928	7e55bdeff8cc2a3cb72cf193e3dac16cfaef2a3019f43bed1f115472b2b44849.exe	WerFault.exe
PID 1928 wrote to memory of 1324	1928	7e55bdeff8cc2a3cb72cf193e3dac16cfaef2a3019f43bed1f115472b2b44849.exe	WerFault.exe
PID 1928 wrote to memory of 1324	1928	7e55bdeff8cc2a3cb72cf193e3dac16cfaef2a3019f43bed1f115472b2b44849.exe	WerFault.exe
PID 1928 wrote to memory of 1324	1928	7e55bdeff8cc2a3cb72cf193e3dac16cfaef2a3019f43bed1f115472b2b44849.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7e55bdeff8cc2a3cb72cf193e3dac16cfaef2a3019f43bed1f115472b2b44849.exe
"C:\Users\Admin\AppData\Local\Temp\7e55bdeff8cc2a3cb72cf193e3dac16cfaef2a3019f43bed1f115472b2b44849.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928

memory/1324-59-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1928-54-0x0000000002CDD000-0x0000000002D59000-memory.dmp

Filesize
496KB

Download
memory/1928-55-0x0000000075341000-0x0000000075343000-memory.dmp

Filesize
8KB

Download
memory/1928-56-0x0000000002CDD000-0x0000000002D59000-memory.dmp

Filesize
496KB

Download
memory/1928-57-0x0000000002BB0000-0x0000000002C85000-memory.dmp

Filesize
852KB

Download
memory/1928-58-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download