vidar | 04927fb6b7abf7ff94b7b5f3ae72a3745d19e6e7088763e3e121b9f54a5d905c

Analysis

Target

04927fb6b7abf7ff94b7b5f3ae72a3745d19e6e7088763e3e121b9f54a5d905c.exe
Size

679KB
MD5

8e998231db502501ae9d1340717c5e93
SHA1

852e491a3a3e61e5fa85927c7cb39c1618f61e0c
SHA256

04927fb6b7abf7ff94b7b5f3ae72a3745d19e6e7088763e3e121b9f54a5d905c
SHA512

b8a2beffcc5a7cdf6e4b2ce91de592a97cef45f6813198e457c979f57949276d8aa1b4077243d064c00913c900c8ff3c5c27abb199bc9f9941eee4ce9ac9a8d8

Score

10^/10

vidar 937 stealer

Family

vidar

Version

48.5

Botnet

937

https://koyu.space/@tttaj

Attributes

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1288-56-0x0000000001D00000-0x0000000001DD5000-memory.dmp	family_vidar
behavioral1/memory/1288-57-0x0000000000400000-0x00000000004D8000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

624 1288 WerFault.exe 04927fb6b7abf7ff94b7b5f3ae72a3745d19e6e7088763e3e121b9f54a5d905c.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

624 WerFault.exe
624 WerFault.exe
624 WerFault.exe
624 WerFault.exe
624 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

624 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 624 WerFault.exe

pid	pid_target	process	target process
624	1288	WerFault.exe	04927fb6b7abf7ff94b7b5f3ae72a3745d19e6e7088763e3e121b9f54a5d905c.exe

pid	process
624	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	624	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

04927fb6b7abf7ff94b7b5f3ae72a3745d19e6e7088763e3e121b9f54a5d905c.exe

description	pid	process	target process
PID 1288 wrote to memory of 624	1288	04927fb6b7abf7ff94b7b5f3ae72a3745d19e6e7088763e3e121b9f54a5d905c.exe	WerFault.exe
PID 1288 wrote to memory of 624	1288	04927fb6b7abf7ff94b7b5f3ae72a3745d19e6e7088763e3e121b9f54a5d905c.exe	WerFault.exe
PID 1288 wrote to memory of 624	1288	04927fb6b7abf7ff94b7b5f3ae72a3745d19e6e7088763e3e121b9f54a5d905c.exe	WerFault.exe
PID 1288 wrote to memory of 624	1288	04927fb6b7abf7ff94b7b5f3ae72a3745d19e6e7088763e3e121b9f54a5d905c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\04927fb6b7abf7ff94b7b5f3ae72a3745d19e6e7088763e3e121b9f54a5d905c.exe
"C:\Users\Admin\AppData\Local\Temp\04927fb6b7abf7ff94b7b5f3ae72a3745d19e6e7088763e3e121b9f54a5d905c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288

memory/624-58-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1288-54-0x0000000075471000-0x0000000075473000-memory.dmp

Filesize
8KB

Download
memory/1288-55-0x0000000000220000-0x000000000029B000-memory.dmp

Filesize
492KB

Download
memory/1288-56-0x0000000001D00000-0x0000000001DD5000-memory.dmp

Filesize
852KB

Download
memory/1288-57-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download