vidar | 6f20e8f1b4514204c76ee6ac5fccf35e637546bdd9f8739b709d66dd3748e3c6

Analysis

Target

6f20e8f1b4514204c76ee6ac5fccf35e637546bdd9f8739b709d66dd3748e3c6.exe
Size

628KB
MD5

761674fa96c65b579d2918c740712e19
SHA1

ff96a97efdd1e9bc2c1c8ae5a6650fbf314b79bb
SHA256

6f20e8f1b4514204c76ee6ac5fccf35e637546bdd9f8739b709d66dd3748e3c6
SHA512

68ad01b44293b2380f1a0560ccbf53b06d82bd526a3c5179ce9697a24331159810380606ee9a51706abac076d3a7dce7c7de7943ac076372c1613f17a22c63a2

Score

10^/10

vidar 933 stealer

Family

vidar

Version

48.2

Botnet

933

https://koyu.space/@qmashton

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1636-56-0x0000000001D90000-0x0000000001E65000-memory.dmp	family_vidar
behavioral1/memory/1636-57-0x0000000000400000-0x00000000004D8000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

540 1636 WerFault.exe 6f20e8f1b4514204c76ee6ac5fccf35e637546bdd9f8739b709d66dd3748e3c6.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

540 WerFault.exe
540 WerFault.exe
540 WerFault.exe
540 WerFault.exe
540 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

540 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 540 WerFault.exe

pid	pid_target	process	target process
540	1636	WerFault.exe	6f20e8f1b4514204c76ee6ac5fccf35e637546bdd9f8739b709d66dd3748e3c6.exe

pid	process
540	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	540	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6f20e8f1b4514204c76ee6ac5fccf35e637546bdd9f8739b709d66dd3748e3c6.exe

description	pid	process	target process
PID 1636 wrote to memory of 540	1636	6f20e8f1b4514204c76ee6ac5fccf35e637546bdd9f8739b709d66dd3748e3c6.exe	WerFault.exe
PID 1636 wrote to memory of 540	1636	6f20e8f1b4514204c76ee6ac5fccf35e637546bdd9f8739b709d66dd3748e3c6.exe	WerFault.exe
PID 1636 wrote to memory of 540	1636	6f20e8f1b4514204c76ee6ac5fccf35e637546bdd9f8739b709d66dd3748e3c6.exe	WerFault.exe
PID 1636 wrote to memory of 540	1636	6f20e8f1b4514204c76ee6ac5fccf35e637546bdd9f8739b709d66dd3748e3c6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6f20e8f1b4514204c76ee6ac5fccf35e637546bdd9f8739b709d66dd3748e3c6.exe
"C:\Users\Admin\AppData\Local\Temp\6f20e8f1b4514204c76ee6ac5fccf35e637546bdd9f8739b709d66dd3748e3c6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636

memory/540-58-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1636-54-0x0000000076421000-0x0000000076423000-memory.dmp

Filesize
8KB

Download
memory/1636-55-0x00000000002C0000-0x000000000033B000-memory.dmp

Filesize
492KB

Download
memory/1636-56-0x0000000001D90000-0x0000000001E65000-memory.dmp

Filesize
852KB

Download
memory/1636-57-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download