vidar | fe05b66d6140aec7855bb58fcf186c8529c3a7630d0985f5201b31f92d9d63fe

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 08:36

Target

12669aaffc7529caec004ae9b351e592.exe
Size

521KB
MD5

12669aaffc7529caec004ae9b351e592
SHA1

31705c2612209846bd09e1c98f57f9d0badff58a
SHA256

fe05b66d6140aec7855bb58fcf186c8529c3a7630d0985f5201b31f92d9d63fe
SHA512

bc360e071afd2e082f931925d7541311ae43d093030c58fb1cd48e5bf2487c1392b1b51c27276d67c88a9469fb1181440ce0a9e6f608442d20e8c5bc287df095
SSDEEP

12288:ldgzNv4IG3MQLQ+RSKua8PB3JsdAZvfGA2NWRTL3zK+fY:ldgSIV0Q+vbSsdAZHONWxnvfY

Score

10^/10

vidar 921 stealer

Family

vidar

Version

39.7

Botnet

921

https://shpak125.tumblr.com/

Attributes

Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/5032-6-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/5032-8-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/5032-9-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/5032-11-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/5032-21-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

12669aaffc7529caec004ae9b351e592.exe

description pid process target process

PID 3000 set thread context of 5032 3000 12669aaffc7529caec004ae9b351e592.exe 12669aaffc7529caec004ae9b351e592.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

12669aaffc7529caec004ae9b351e592.exe

description pid process

Token: SeDebugPrivilege 3000 12669aaffc7529caec004ae9b351e592.exe

description	pid	process	target process
PID 3000 set thread context of 5032	3000	12669aaffc7529caec004ae9b351e592.exe	12669aaffc7529caec004ae9b351e592.exe

description	pid	process
Token: SeDebugPrivilege	3000	12669aaffc7529caec004ae9b351e592.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

12669aaffc7529caec004ae9b351e592.exe

description	pid	process	target process
PID 3000 wrote to memory of 5032	3000	12669aaffc7529caec004ae9b351e592.exe	12669aaffc7529caec004ae9b351e592.exe
PID 3000 wrote to memory of 5032	3000	12669aaffc7529caec004ae9b351e592.exe	12669aaffc7529caec004ae9b351e592.exe
PID 3000 wrote to memory of 5032	3000	12669aaffc7529caec004ae9b351e592.exe	12669aaffc7529caec004ae9b351e592.exe
PID 3000 wrote to memory of 5032	3000	12669aaffc7529caec004ae9b351e592.exe	12669aaffc7529caec004ae9b351e592.exe
PID 3000 wrote to memory of 5032	3000	12669aaffc7529caec004ae9b351e592.exe	12669aaffc7529caec004ae9b351e592.exe
PID 3000 wrote to memory of 5032	3000	12669aaffc7529caec004ae9b351e592.exe	12669aaffc7529caec004ae9b351e592.exe
PID 3000 wrote to memory of 5032	3000	12669aaffc7529caec004ae9b351e592.exe	12669aaffc7529caec004ae9b351e592.exe
PID 3000 wrote to memory of 5032	3000	12669aaffc7529caec004ae9b351e592.exe	12669aaffc7529caec004ae9b351e592.exe

C:\Users\Admin\AppData\Local\Temp\12669aaffc7529caec004ae9b351e592.exe
C:\Users\Admin\AppData\Local\Temp\12669aaffc7529caec004ae9b351e592.exe
2⤵
PID:5032

memory/3000-1-0x0000000075060000-0x0000000075810000-memory.dmp

Filesize
7.7MB

Download
memory/3000-0-0x00000000001C0000-0x0000000000246000-memory.dmp

Filesize
536KB

Download
memory/3000-2-0x0000000004D40000-0x0000000004D50000-memory.dmp

Filesize
64KB

Download
memory/3000-3-0x0000000004BD0000-0x0000000004BE4000-memory.dmp

Filesize
80KB

Download
memory/3000-4-0x0000000004C60000-0x0000000004CD6000-memory.dmp

Filesize
472KB

Download
memory/3000-5-0x0000000004C30000-0x0000000004C4E000-memory.dmp

Filesize
120KB

Download
memory/3000-10-0x0000000075060000-0x0000000075810000-memory.dmp

Filesize
7.7MB

Download
memory/5032-6-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/5032-8-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/5032-9-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/5032-11-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/5032-21-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download