vidar | 26554dca1108a1e319762acf387f72acb75a759ac852570bad7e1c92739f78e1

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 16:41

Target

064678730382db3dd2f3b6d2f33051f0.exe
Size

603KB
MD5

064678730382db3dd2f3b6d2f33051f0
SHA1

a6bdd54fa4da526ae2a89d53e9aff421137e1121
SHA256

26554dca1108a1e319762acf387f72acb75a759ac852570bad7e1c92739f78e1
SHA512

5b429e1ecb58e6923b671bfafa6e2092c424e4af6e2c4e3b25b7d812cd44bd84505d6f1264b786a307099dffcb9b8122bfcbe5cb7fbd9183d94bfcc8b10f6497
SSDEEP

12288:mBn0WC2QEd7rehZ0sJde/IyrzLCiqfWUinTDNnrto2MNXOBPAi:mB0WC2Ld7reZ0sJo/9rzLC7LiHt5o2MV

Score

10^/10

vidar 818 stealer

Family

vidar

Version

39.7

Botnet

818

https://shpak125.tumblr.com/

Attributes

Vidar Stealer 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/3448-2-0x00000000026B0000-0x000000000274D000-memory.dmp	family_vidar
behavioral2/memory/3448-3-0x0000000000400000-0x0000000000901000-memory.dmp	family_vidar
behavioral2/memory/3448-10-0x0000000000400000-0x0000000000901000-memory.dmp	family_vidar
behavioral2/memory/3448-15-0x00000000026B0000-0x000000000274D000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2284 3448 WerFault.exe 064678730382db3dd2f3b6d2f33051f0.exe

pid	pid_target	process	target process
2284	3448	WerFault.exe	064678730382db3dd2f3b6d2f33051f0.exe

C:\Users\Admin\AppData\Local\Temp\064678730382db3dd2f3b6d2f33051f0.exe
"C:\Users\Admin\AppData\Local\Temp\064678730382db3dd2f3b6d2f33051f0.exe"
1⤵
PID:3448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 1576
2⤵
- Program crash
PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3448 -ip 3448
1⤵
PID:4200

memory/3448-2-0x00000000026B0000-0x000000000274D000-memory.dmp

Filesize
628KB

Download
memory/3448-1-0x0000000000C10000-0x0000000000D10000-memory.dmp

Filesize
1024KB

Download
memory/3448-3-0x0000000000400000-0x0000000000901000-memory.dmp

Filesize
5.0MB

Download
memory/3448-10-0x0000000000400000-0x0000000000901000-memory.dmp

Filesize
5.0MB

Download
memory/3448-15-0x00000000026B0000-0x000000000274D000-memory.dmp

Filesize
628KB

Download