vidar | 81f0ea7ee9873de0118f7a630ea06da4072c8bd582ed4dc753a0124e1adb1584

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2023 13:09

Target

b145481b3a46c0e94f36eb367b4fb547.exe
Size

502KB
MD5

b145481b3a46c0e94f36eb367b4fb547
SHA1

2206daf1a6e4ff8706df648888caa3bdbe5a8d6e
SHA256

81f0ea7ee9873de0118f7a630ea06da4072c8bd582ed4dc753a0124e1adb1584
SHA512

272a600c0586ef8525ad5c5c5698afbe35c65d7f9d2bb8222ba372077dc095e3159b5a973f190d67dc6e36bb56c76770f21ec36748ca18dab95c74273d0de1e3
SSDEEP

12288:YEF5nudgzNv4IG3MQLQ+RSKua8PB3JsdAZvfGA2ngUSA:YE+dgSIV0Q+vbSsdAZHOxSA

Score

10^/10

vidar 921 stealer

Family

vidar

Version

39.7

Botnet

921

https://shpak125.tumblr.com/

Attributes

Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/3436-6-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/3436-8-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/3436-10-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/3436-11-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/3436-21-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

b145481b3a46c0e94f36eb367b4fb547.exe

description pid process target process

PID 4148 set thread context of 3436 4148 b145481b3a46c0e94f36eb367b4fb547.exe b145481b3a46c0e94f36eb367b4fb547.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4676 3436 WerFault.exe b145481b3a46c0e94f36eb367b4fb547.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b145481b3a46c0e94f36eb367b4fb547.exe

description pid process

Token: SeDebugPrivilege 4148 b145481b3a46c0e94f36eb367b4fb547.exe

description	pid	process	target process
PID 4148 set thread context of 3436	4148	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe

pid	pid_target	process	target process
4676	3436	WerFault.exe	b145481b3a46c0e94f36eb367b4fb547.exe

description	pid	process
Token: SeDebugPrivilege	4148	b145481b3a46c0e94f36eb367b4fb547.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

b145481b3a46c0e94f36eb367b4fb547.exe

description	pid	process	target process
PID 4148 wrote to memory of 3056	4148	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 4148 wrote to memory of 3056	4148	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 4148 wrote to memory of 3056	4148	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 4148 wrote to memory of 3436	4148	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 4148 wrote to memory of 3436	4148	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 4148 wrote to memory of 3436	4148	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 4148 wrote to memory of 3436	4148	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 4148 wrote to memory of 3436	4148	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 4148 wrote to memory of 3436	4148	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 4148 wrote to memory of 3436	4148	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe
PID 4148 wrote to memory of 3436	4148	b145481b3a46c0e94f36eb367b4fb547.exe	b145481b3a46c0e94f36eb367b4fb547.exe

C:\Users\Admin\AppData\Local\Temp\b145481b3a46c0e94f36eb367b4fb547.exe
C:\Users\Admin\AppData\Local\Temp\b145481b3a46c0e94f36eb367b4fb547.exe
2⤵
PID:3056

C:\Users\Admin\AppData\Local\Temp\b145481b3a46c0e94f36eb367b4fb547.exe
C:\Users\Admin\AppData\Local\Temp\b145481b3a46c0e94f36eb367b4fb547.exe
2⤵
PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 1792
3⤵
- Program crash
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3436 -ip 3436
1⤵
PID:4268

memory/3436-6-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3436-8-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3436-10-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3436-11-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3436-21-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4148-0-0x0000000000DA0000-0x0000000000E20000-memory.dmp

Filesize
512KB

Download
memory/4148-1-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/4148-2-0x00000000057D0000-0x00000000057E0000-memory.dmp

Filesize
64KB

Download
memory/4148-3-0x0000000003230000-0x0000000003244000-memory.dmp

Filesize
80KB

Download
memory/4148-4-0x0000000005860000-0x00000000058D6000-memory.dmp

Filesize
472KB

Download
memory/4148-5-0x0000000005810000-0x000000000582E000-memory.dmp

Filesize
120KB

Download
memory/4148-9-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download