vidar | 5ff54b5854150bee967022955d90ff2e1ae463c1da3755be965935fe6663e85c

Analysis

max time kernel
197s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 07:54

Target

5ff54b5854150bee967022955d90ff2e1ae463c1da3755be965935fe6663e85c.exe
Size

646KB
MD5

8d271b490de93ca2ec59c01be6d6b777
SHA1

6be497424832a88ae40ec57d0ff4e5bc0011ea3c
SHA256

5ff54b5854150bee967022955d90ff2e1ae463c1da3755be965935fe6663e85c
SHA512

5ce275f605bd4b6c6aba1bcf076eeff590a850f256c1a215ff1c13d41e6ec93777de441cf1e93fd11fcc304813341dd70b6a27b318f3a843b13123451d294f1e

Score

10^/10

vidar 933 stealer

Family

vidar

Version

41.6

Botnet

933

https://mas.to/@lilocc

Attributes

Vidar Stealer 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/4168-131-0x0000000004CC0000-0x0000000004D96000-memory.dmp	family_vidar
behavioral2/memory/4168-132-0x0000000000400000-0x0000000002F67000-memory.dmp	family_vidar
behavioral2/memory/4168-133-0x0000000004CC0000-0x0000000004D96000-memory.dmp	family_vidar
behavioral2/memory/4168-134-0x0000000000400000-0x0000000002F67000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5104 4168 WerFault.exe 5ff54b5854150bee967022955d90ff2e1ae463c1da3755be965935fe6663e85c.exe

pid	pid_target	process	target process
5104	4168	WerFault.exe	5ff54b5854150bee967022955d90ff2e1ae463c1da3755be965935fe6663e85c.exe

C:\Users\Admin\AppData\Local\Temp\5ff54b5854150bee967022955d90ff2e1ae463c1da3755be965935fe6663e85c.exe
"C:\Users\Admin\AppData\Local\Temp\5ff54b5854150bee967022955d90ff2e1ae463c1da3755be965935fe6663e85c.exe"
1⤵
PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 1868
2⤵
- Program crash
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4168 -ip 4168
1⤵
PID:4496

memory/4168-130-0x0000000004C40000-0x0000000004CBC000-memory.dmp

Filesize
496KB

Download
memory/4168-131-0x0000000004CC0000-0x0000000004D96000-memory.dmp

Filesize
856KB

Download
memory/4168-132-0x0000000000400000-0x0000000002F67000-memory.dmp

Filesize
43.4MB

Download
memory/4168-133-0x0000000004CC0000-0x0000000004D96000-memory.dmp

Filesize
856KB

Download
memory/4168-134-0x0000000000400000-0x0000000002F67000-memory.dmp

Filesize
43.4MB

Download