vidar | 317e6d0c61edc2d145f8f29a19e1ecee049f6f3cff8decd0f5d8171ab99f9813

Analysis

Target

317e6d0c61edc2d145f8f29a19e1ecee049f6f3cff8decd0f5d8171ab99f9813.exe
Size

640KB
MD5

81843d9c10e65eeead6650766ba18d08
SHA1

618f493341aea26dc4d7c46dae854d5c1d56bcbf
SHA256

317e6d0c61edc2d145f8f29a19e1ecee049f6f3cff8decd0f5d8171ab99f9813
SHA512

89a75dcb396ab86a4bb495ed14176b2f0a7b31949fbba02e8cdcb04967595269048dd95683391e16cd431c235ff90d5a62e616ac997cb9f983a7f358dc3dab63

Score

10^/10

vidar 937 stealer

Family

vidar

Version

41.6

Botnet

937

https://mas.to/@lilocc

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1032-56-0x0000000000560000-0x0000000000636000-memory.dmp	family_vidar
behavioral1/memory/1032-57-0x0000000000400000-0x00000000004D9000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1852 1032 WerFault.exe 317e6d0c61edc2d145f8f29a19e1ecee049f6f3cff8decd0f5d8171ab99f9813.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1852 WerFault.exe
1852 WerFault.exe
1852 WerFault.exe
1852 WerFault.exe
1852 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1852 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1852 WerFault.exe

pid	pid_target	process	target process
1852	1032	WerFault.exe	317e6d0c61edc2d145f8f29a19e1ecee049f6f3cff8decd0f5d8171ab99f9813.exe

pid	process
1852	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1852	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

317e6d0c61edc2d145f8f29a19e1ecee049f6f3cff8decd0f5d8171ab99f9813.exe

description	pid	process	target process
PID 1032 wrote to memory of 1852	1032	317e6d0c61edc2d145f8f29a19e1ecee049f6f3cff8decd0f5d8171ab99f9813.exe	WerFault.exe
PID 1032 wrote to memory of 1852	1032	317e6d0c61edc2d145f8f29a19e1ecee049f6f3cff8decd0f5d8171ab99f9813.exe	WerFault.exe
PID 1032 wrote to memory of 1852	1032	317e6d0c61edc2d145f8f29a19e1ecee049f6f3cff8decd0f5d8171ab99f9813.exe	WerFault.exe
PID 1032 wrote to memory of 1852	1032	317e6d0c61edc2d145f8f29a19e1ecee049f6f3cff8decd0f5d8171ab99f9813.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\317e6d0c61edc2d145f8f29a19e1ecee049f6f3cff8decd0f5d8171ab99f9813.exe
"C:\Users\Admin\AppData\Local\Temp\317e6d0c61edc2d145f8f29a19e1ecee049f6f3cff8decd0f5d8171ab99f9813.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1032

memory/1032-54-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1032-55-0x00000000004E0000-0x000000000055C000-memory.dmp

Filesize
496KB

Download
memory/1032-56-0x0000000000560000-0x0000000000636000-memory.dmp

Filesize
856KB

Download
memory/1032-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1852-58-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download