vidar | 4227ee74e68b799efeb3613493f4814a81e16fec32c88bcc3fdcc7eae35b60bc

Analysis

max time kernel
22s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2023 19:18

Target

f1e89356f7a21887e4b5db1160717abf.exe
Size

581KB
MD5

f1e89356f7a21887e4b5db1160717abf
SHA1

ff7409ec73309460650dccc2e44efb8595c246d7
SHA256

4227ee74e68b799efeb3613493f4814a81e16fec32c88bcc3fdcc7eae35b60bc
SHA512

891734162b8f4b5c1d9cc08cc9c8140edbdf8af2ca4b0819a860cc1c1887d041e25db1b4282069ebeea6d764846d5d20ba3e836d923b1e3886f468236b244e51
SSDEEP

12288:qxOZuX86JY1oowOZ6XxAiVrjJgostVjXl+2U9rKicYz:qs8XfeXv6T7YH7l+2GrKicYz

Score

10^/10

vidar 921 stealer

Family

vidar

Version

39.8

Botnet

921

https://xeronxikxxx.tumblr.com/

Attributes

Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/664-11-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/664-9-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/664-8-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/664-6-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/664-21-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

f1e89356f7a21887e4b5db1160717abf.exe

description pid process target process

PID 1640 set thread context of 664 1640 f1e89356f7a21887e4b5db1160717abf.exe f1e89356f7a21887e4b5db1160717abf.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2644 664 WerFault.exe f1e89356f7a21887e4b5db1160717abf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f1e89356f7a21887e4b5db1160717abf.exe

description pid process

Token: SeDebugPrivilege 1640 f1e89356f7a21887e4b5db1160717abf.exe

description	pid	process	target process
PID 1640 set thread context of 664	1640	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe

pid	pid_target	process	target process
2644	664	WerFault.exe	f1e89356f7a21887e4b5db1160717abf.exe

description	pid	process
Token: SeDebugPrivilege	1640	f1e89356f7a21887e4b5db1160717abf.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

f1e89356f7a21887e4b5db1160717abf.exe

description	pid	process	target process
PID 1640 wrote to memory of 664	1640	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe
PID 1640 wrote to memory of 664	1640	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe
PID 1640 wrote to memory of 664	1640	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe
PID 1640 wrote to memory of 664	1640	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe
PID 1640 wrote to memory of 664	1640	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe
PID 1640 wrote to memory of 664	1640	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe
PID 1640 wrote to memory of 664	1640	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe
PID 1640 wrote to memory of 664	1640	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe

C:\Users\Admin\AppData\Local\Temp\f1e89356f7a21887e4b5db1160717abf.exe
C:\Users\Admin\AppData\Local\Temp\f1e89356f7a21887e4b5db1160717abf.exe
2⤵
PID:664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1764
3⤵
- Program crash
PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 664 -ip 664
1⤵
PID:5052

memory/664-11-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/664-9-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/664-8-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/664-6-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/664-21-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1640-1-0x0000000075170000-0x0000000075920000-memory.dmp

Filesize
7.7MB

Download
memory/1640-0-0x0000000000A30000-0x0000000000AC4000-memory.dmp

Filesize
592KB

Download
memory/1640-2-0x0000000005460000-0x0000000005470000-memory.dmp

Filesize
64KB

Download
memory/1640-4-0x0000000005390000-0x0000000005406000-memory.dmp

Filesize
472KB

Download
memory/1640-3-0x00000000052F0000-0x0000000005310000-memory.dmp

Filesize
128KB

Download
memory/1640-5-0x0000000005350000-0x000000000536E000-memory.dmp

Filesize
120KB

Download
memory/1640-10-0x0000000075170000-0x0000000075920000-memory.dmp

Filesize
7.7MB

Download