vidar | 2636faa0941a7fd9a889aeb2e4b94fe95f538a588642750ac87d635fd68b5537

Analysis

max time kernel
146s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 06:27

Target

59901a6b5da704db1ff0fb56eba9e5bb.exe
Size

566KB
MD5

59901a6b5da704db1ff0fb56eba9e5bb
SHA1

e3f2fcdd6540f7ff493be24eb20d0d49e49e086c
SHA256

2636faa0941a7fd9a889aeb2e4b94fe95f538a588642750ac87d635fd68b5537
SHA512

729024477ac50ec08667e4a26406f92996126089e7fc46a083a40f0fc9250fb43c42d3e6add6591bb0e894d664fc2466dcece305a0657cc0aa93ed4634cacbed
SSDEEP

12288:kEgK90j+Kq04O4m/eznig5cGyS7RXusazvEGSTC5eHLCyz2D2X:IK9nri65cm1XkzNS9CVD2X

Score

10^/10

vidar 903 stealer

Family

vidar

Version

39.7

Botnet

903

https://shpak125.tumblr.com/

Attributes

Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/4368-11-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4368-9-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4368-8-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4368-6-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4368-21-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

59901a6b5da704db1ff0fb56eba9e5bb.exe

description pid process target process

PID 2244 set thread context of 4368 2244 59901a6b5da704db1ff0fb56eba9e5bb.exe 59901a6b5da704db1ff0fb56eba9e5bb.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

59901a6b5da704db1ff0fb56eba9e5bb.exe

description pid process

Token: SeDebugPrivilege 2244 59901a6b5da704db1ff0fb56eba9e5bb.exe

description	pid	process	target process
PID 2244 set thread context of 4368	2244	59901a6b5da704db1ff0fb56eba9e5bb.exe	59901a6b5da704db1ff0fb56eba9e5bb.exe

description	pid	process
Token: SeDebugPrivilege	2244	59901a6b5da704db1ff0fb56eba9e5bb.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

59901a6b5da704db1ff0fb56eba9e5bb.exe

description	pid	process	target process
PID 2244 wrote to memory of 4368	2244	59901a6b5da704db1ff0fb56eba9e5bb.exe	59901a6b5da704db1ff0fb56eba9e5bb.exe
PID 2244 wrote to memory of 4368	2244	59901a6b5da704db1ff0fb56eba9e5bb.exe	59901a6b5da704db1ff0fb56eba9e5bb.exe
PID 2244 wrote to memory of 4368	2244	59901a6b5da704db1ff0fb56eba9e5bb.exe	59901a6b5da704db1ff0fb56eba9e5bb.exe
PID 2244 wrote to memory of 4368	2244	59901a6b5da704db1ff0fb56eba9e5bb.exe	59901a6b5da704db1ff0fb56eba9e5bb.exe
PID 2244 wrote to memory of 4368	2244	59901a6b5da704db1ff0fb56eba9e5bb.exe	59901a6b5da704db1ff0fb56eba9e5bb.exe
PID 2244 wrote to memory of 4368	2244	59901a6b5da704db1ff0fb56eba9e5bb.exe	59901a6b5da704db1ff0fb56eba9e5bb.exe
PID 2244 wrote to memory of 4368	2244	59901a6b5da704db1ff0fb56eba9e5bb.exe	59901a6b5da704db1ff0fb56eba9e5bb.exe
PID 2244 wrote to memory of 4368	2244	59901a6b5da704db1ff0fb56eba9e5bb.exe	59901a6b5da704db1ff0fb56eba9e5bb.exe

C:\Users\Admin\AppData\Local\Temp\59901a6b5da704db1ff0fb56eba9e5bb.exe
C:\Users\Admin\AppData\Local\Temp\59901a6b5da704db1ff0fb56eba9e5bb.exe
2⤵
PID:4368

memory/2244-0-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/2244-1-0x00000000007C0000-0x0000000000850000-memory.dmp

Filesize
576KB

Download
memory/2244-2-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download
memory/2244-3-0x0000000005140000-0x0000000005154000-memory.dmp

Filesize
80KB

Download
memory/2244-4-0x0000000005280000-0x00000000052F6000-memory.dmp

Filesize
472KB

Download
memory/2244-5-0x0000000005250000-0x000000000526E000-memory.dmp

Filesize
120KB

Download
memory/2244-10-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/4368-11-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4368-9-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4368-8-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4368-6-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4368-21-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download