vidar | 43e7ee9e95c1b1c52aa97394cba30a5432c0ef81d28c5460c48686e1a0628f6c

Analysis

Target

43e7ee9e95c1b1c52aa97394cba30a5432c0ef81d28c5460c48686e1a0628f6c.exe
Size

612KB
MD5

2055b95f66dd6c98d5d3fd11f3a68587
SHA1

9292ef053d0395fd6084caacdf5e126a2062ff19
SHA256

43e7ee9e95c1b1c52aa97394cba30a5432c0ef81d28c5460c48686e1a0628f6c
SHA512

d5e10ec696d8e900d3e5b05c1ce4034eeec7ea56f30adb2516e028962029fc5dc4e89715c9f28487839b038b9eec0b1471c49eaa25934b04010462cfc140d643

Score

10^/10

vidar 937 stealer

Family

vidar

Version

47.8

Botnet

937

https://mas.to/@romashkin

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1608-57-0x0000000001C90000-0x0000000001D66000-memory.dmp	family_vidar
behavioral1/memory/1608-58-0x0000000000400000-0x00000000004D9000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2040 1608 WerFault.exe 43e7ee9e95c1b1c52aa97394cba30a5432c0ef81d28c5460c48686e1a0628f6c.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

2040 WerFault.exe
2040 WerFault.exe
2040 WerFault.exe
2040 WerFault.exe
2040 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2040 WerFault.exe

pid	pid_target	process	target process
2040	1608	WerFault.exe	43e7ee9e95c1b1c52aa97394cba30a5432c0ef81d28c5460c48686e1a0628f6c.exe

description	pid	process
Token: SeDebugPrivilege	2040	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

43e7ee9e95c1b1c52aa97394cba30a5432c0ef81d28c5460c48686e1a0628f6c.exe

description	pid	process	target process
PID 1608 wrote to memory of 2040	1608	43e7ee9e95c1b1c52aa97394cba30a5432c0ef81d28c5460c48686e1a0628f6c.exe	WerFault.exe
PID 1608 wrote to memory of 2040	1608	43e7ee9e95c1b1c52aa97394cba30a5432c0ef81d28c5460c48686e1a0628f6c.exe	WerFault.exe
PID 1608 wrote to memory of 2040	1608	43e7ee9e95c1b1c52aa97394cba30a5432c0ef81d28c5460c48686e1a0628f6c.exe	WerFault.exe
PID 1608 wrote to memory of 2040	1608	43e7ee9e95c1b1c52aa97394cba30a5432c0ef81d28c5460c48686e1a0628f6c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\43e7ee9e95c1b1c52aa97394cba30a5432c0ef81d28c5460c48686e1a0628f6c.exe
"C:\Users\Admin\AppData\Local\Temp\43e7ee9e95c1b1c52aa97394cba30a5432c0ef81d28c5460c48686e1a0628f6c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1608

memory/1608-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download
memory/1608-56-0x00000000004E0000-0x000000000055C000-memory.dmp

Filesize
496KB

Download
memory/1608-57-0x0000000001C90000-0x0000000001D66000-memory.dmp

Filesize
856KB

Download
memory/1608-58-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2040-59-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download