vidar | bb9a6242991d0d9bf29011e503cb679537dda42fab5451869ce866b3dada19ca

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 09:17

Target

308c3af9d49308ea263e70bc4f946fa0.exe
Size

1.5MB
MD5

308c3af9d49308ea263e70bc4f946fa0
SHA1

962bd5aaa2d7441a27c931932cc003491aa66dad
SHA256

bb9a6242991d0d9bf29011e503cb679537dda42fab5451869ce866b3dada19ca
SHA512

da8fcd80d98a62eaef1a57d87fcb990d47e0ebe2aa0834a16262810b5fd36bcb8f05a08a093e19b3c498277f97adc12f0725f122b7b7047e495f39647cfee40f
SSDEEP

24576:9xSiXHVIHkbV5qXeRqVo5h1VPpcGWjNr3Vw/MP85slp+t4ioscQPFc8HTWK0g+WA:9Qi3VIek5Vo5PcQUPhZxQSUDV+W2x

Score

10^/10

vidar 921 stealer

Family

vidar

Version

39.9

Botnet

921

https://prophefliloc.tumblr.com/

Attributes

Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/3884-8-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/3884-9-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/3884-11-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/3884-14-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/3884-25-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

308c3af9d49308ea263e70bc4f946fa0.exe

description pid process target process

PID 2404 set thread context of 3884 2404 308c3af9d49308ea263e70bc4f946fa0.exe 308c3af9d49308ea263e70bc4f946fa0.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1664 3884 WerFault.exe 308c3af9d49308ea263e70bc4f946fa0.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

308c3af9d49308ea263e70bc4f946fa0.exe

description pid process

Token: SeDebugPrivilege 2404 308c3af9d49308ea263e70bc4f946fa0.exe

description	pid	process	target process
PID 2404 set thread context of 3884	2404	308c3af9d49308ea263e70bc4f946fa0.exe	308c3af9d49308ea263e70bc4f946fa0.exe

pid	pid_target	process	target process
1664	3884	WerFault.exe	308c3af9d49308ea263e70bc4f946fa0.exe

description	pid	process
Token: SeDebugPrivilege	2404	308c3af9d49308ea263e70bc4f946fa0.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

308c3af9d49308ea263e70bc4f946fa0.exe

description	pid	process	target process
PID 2404 wrote to memory of 2240	2404	308c3af9d49308ea263e70bc4f946fa0.exe	308c3af9d49308ea263e70bc4f946fa0.exe
PID 2404 wrote to memory of 2240	2404	308c3af9d49308ea263e70bc4f946fa0.exe	308c3af9d49308ea263e70bc4f946fa0.exe
PID 2404 wrote to memory of 2240	2404	308c3af9d49308ea263e70bc4f946fa0.exe	308c3af9d49308ea263e70bc4f946fa0.exe
PID 2404 wrote to memory of 3884	2404	308c3af9d49308ea263e70bc4f946fa0.exe	308c3af9d49308ea263e70bc4f946fa0.exe
PID 2404 wrote to memory of 3884	2404	308c3af9d49308ea263e70bc4f946fa0.exe	308c3af9d49308ea263e70bc4f946fa0.exe
PID 2404 wrote to memory of 3884	2404	308c3af9d49308ea263e70bc4f946fa0.exe	308c3af9d49308ea263e70bc4f946fa0.exe
PID 2404 wrote to memory of 3884	2404	308c3af9d49308ea263e70bc4f946fa0.exe	308c3af9d49308ea263e70bc4f946fa0.exe
PID 2404 wrote to memory of 3884	2404	308c3af9d49308ea263e70bc4f946fa0.exe	308c3af9d49308ea263e70bc4f946fa0.exe
PID 2404 wrote to memory of 3884	2404	308c3af9d49308ea263e70bc4f946fa0.exe	308c3af9d49308ea263e70bc4f946fa0.exe
PID 2404 wrote to memory of 3884	2404	308c3af9d49308ea263e70bc4f946fa0.exe	308c3af9d49308ea263e70bc4f946fa0.exe
PID 2404 wrote to memory of 3884	2404	308c3af9d49308ea263e70bc4f946fa0.exe	308c3af9d49308ea263e70bc4f946fa0.exe

C:\Users\Admin\AppData\Local\Temp\308c3af9d49308ea263e70bc4f946fa0.exe
C:\Users\Admin\AppData\Local\Temp\308c3af9d49308ea263e70bc4f946fa0.exe
2⤵
PID:2240

C:\Users\Admin\AppData\Local\Temp\308c3af9d49308ea263e70bc4f946fa0.exe
C:\Users\Admin\AppData\Local\Temp\308c3af9d49308ea263e70bc4f946fa0.exe
2⤵
PID:3884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 1688
3⤵
- Program crash
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3884 -ip 3884
1⤵
PID:2364

memory/2404-13-0x0000000005950000-0x0000000005960000-memory.dmp

Filesize
64KB

Download
memory/2404-12-0x0000000074EC0000-0x0000000075670000-memory.dmp

Filesize
7.7MB

Download
memory/2404-2-0x0000000005950000-0x0000000005960000-memory.dmp

Filesize
64KB

Download
memory/2404-3-0x0000000003090000-0x0000000003091000-memory.dmp

Filesize
4KB

Download
memory/2404-7-0x00000000057E0000-0x0000000005806000-memory.dmp

Filesize
152KB

Download
memory/2404-5-0x0000000005640000-0x00000000056D2000-memory.dmp

Filesize
584KB

Download
memory/2404-0-0x0000000074EC0000-0x0000000075670000-memory.dmp

Filesize
7.7MB

Download
memory/2404-6-0x00000000032E0000-0x00000000032EA000-memory.dmp

Filesize
40KB

Download
memory/2404-4-0x0000000005F10000-0x00000000064B4000-memory.dmp

Filesize
5.6MB

Download
memory/2404-15-0x0000000074EC0000-0x0000000075670000-memory.dmp

Filesize
7.7MB

Download
memory/2404-1-0x0000000000A60000-0x0000000000BE2000-memory.dmp

Filesize
1.5MB

Download
memory/3884-8-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3884-11-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3884-14-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3884-9-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3884-25-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download