vidar | fa7f5b950d340ec4da7c437fe32031f22985034130cec41e7fd7f55c80778f38

Analysis

max time kernel
140s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2023 08:50

Target

ab292ca19cdf082ca574079c509ac729.exe
Size

750KB
MD5

ab292ca19cdf082ca574079c509ac729
SHA1

dedb710717bd0f77afb43b3e4d35c7a38d432ad0
SHA256

fa7f5b950d340ec4da7c437fe32031f22985034130cec41e7fd7f55c80778f38
SHA512

403bae833e8057a286b23ab9eaccc3be9e2d4eb295ebfd65af6d7bfbd9e8ef1d1e29015c80b13068806495e5979ef20f207fe6d76b3521bc02f7c0e80adeff89
SSDEEP

12288:tkBuS8FtXOsOr7tIShXIxy2CKrXbVExkSxOZuX86JY1oowOZ6XxAiVrjJgostV2a:trN0f7Sagy2TrXbV8kSs8XfeXv6T7YHP

Score

10^/10

vidar 921 stealer

Family

vidar

Version

39.8

Botnet

921

https://xeronxikxxx.tumblr.com/

Attributes

Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/4320-5-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4320-7-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4320-8-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4320-10-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4320-20-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

ab292ca19cdf082ca574079c509ac729.exe

description pid process target process

PID 2636 set thread context of 4320 2636 ab292ca19cdf082ca574079c509ac729.exe ab292ca19cdf082ca574079c509ac729.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2636 4320 WerFault.exe ab292ca19cdf082ca574079c509ac729.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ab292ca19cdf082ca574079c509ac729.exe

description pid process

Token: SeDebugPrivilege 2636 ab292ca19cdf082ca574079c509ac729.exe

description	pid	process	target process
PID 2636 set thread context of 4320	2636	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe

pid	pid_target	process	target process
2636	4320	WerFault.exe	ab292ca19cdf082ca574079c509ac729.exe

description	pid	process
Token: SeDebugPrivilege	2636	ab292ca19cdf082ca574079c509ac729.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ab292ca19cdf082ca574079c509ac729.exe

description	pid	process	target process
PID 2636 wrote to memory of 4320	2636	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 2636 wrote to memory of 4320	2636	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 2636 wrote to memory of 4320	2636	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 2636 wrote to memory of 4320	2636	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 2636 wrote to memory of 4320	2636	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 2636 wrote to memory of 4320	2636	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 2636 wrote to memory of 4320	2636	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 2636 wrote to memory of 4320	2636	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe

C:\Users\Admin\AppData\Local\Temp\ab292ca19cdf082ca574079c509ac729.exe
C:\Users\Admin\AppData\Local\Temp\ab292ca19cdf082ca574079c509ac729.exe
2⤵
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 1564
3⤵
- Program crash
PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4320 -ip 4320
1⤵
PID:368

memory/2636-0-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/2636-1-0x00000000007C0000-0x000000000087E000-memory.dmp

Filesize
760KB

Download
memory/2636-3-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/2636-2-0x0000000005230000-0x0000000005240000-memory.dmp

Filesize
64KB

Download
memory/2636-4-0x00000000051F0000-0x0000000005218000-memory.dmp

Filesize
160KB

Download
memory/2636-9-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/4320-5-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4320-7-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4320-8-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4320-10-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4320-20-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download