vidar | 385ae35320b34cb36b132d0945a583543b704e4ab65f8e111e72edc9b94f2f46

Analysis

max time kernel
165s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 08:44

Target

2f8410c9e4ecb1f13a60c58f52d98db3.exe
Size

810KB
MD5

2f8410c9e4ecb1f13a60c58f52d98db3
SHA1

67046fb854573439492ee004e0f010cbef4ae7c6
SHA256

385ae35320b34cb36b132d0945a583543b704e4ab65f8e111e72edc9b94f2f46
SHA512

cc644a667e5cda8dfac8c7d88f27d3b323e54a39edd95eb983f51632765f18b97e0c9dbcd4f844d3bfd97a87dc8b99c29481a9ab555a4d8464f460b641250fe8
SSDEEP

24576:Is8XfeXv6T7YHdmdOF61RR3NQH+J3DR8/RhJ62:fefeXvKsHdyOujm4TKN

Score

10^/10

vidar 921 stealer

Family

vidar

Version

39.8

Botnet

921

https://xeronxikxxx.tumblr.com/

Attributes

Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/5016-9-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/5016-10-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/5016-12-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/5016-13-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/5016-24-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

2f8410c9e4ecb1f13a60c58f52d98db3.exe

description pid process target process

PID 1728 set thread context of 5016 1728 2f8410c9e4ecb1f13a60c58f52d98db3.exe 2f8410c9e4ecb1f13a60c58f52d98db3.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3656 5016 WerFault.exe 2f8410c9e4ecb1f13a60c58f52d98db3.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2f8410c9e4ecb1f13a60c58f52d98db3.exe

description pid process

Token: SeDebugPrivilege 1728 2f8410c9e4ecb1f13a60c58f52d98db3.exe

description	pid	process	target process
PID 1728 set thread context of 5016	1728	2f8410c9e4ecb1f13a60c58f52d98db3.exe	2f8410c9e4ecb1f13a60c58f52d98db3.exe

pid	pid_target	process	target process
3656	5016	WerFault.exe	2f8410c9e4ecb1f13a60c58f52d98db3.exe

description	pid	process
Token: SeDebugPrivilege	1728	2f8410c9e4ecb1f13a60c58f52d98db3.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

2f8410c9e4ecb1f13a60c58f52d98db3.exe

description	pid	process	target process
PID 1728 wrote to memory of 4328	1728	2f8410c9e4ecb1f13a60c58f52d98db3.exe	2f8410c9e4ecb1f13a60c58f52d98db3.exe
PID 1728 wrote to memory of 4328	1728	2f8410c9e4ecb1f13a60c58f52d98db3.exe	2f8410c9e4ecb1f13a60c58f52d98db3.exe
PID 1728 wrote to memory of 4328	1728	2f8410c9e4ecb1f13a60c58f52d98db3.exe	2f8410c9e4ecb1f13a60c58f52d98db3.exe
PID 1728 wrote to memory of 5016	1728	2f8410c9e4ecb1f13a60c58f52d98db3.exe	2f8410c9e4ecb1f13a60c58f52d98db3.exe
PID 1728 wrote to memory of 5016	1728	2f8410c9e4ecb1f13a60c58f52d98db3.exe	2f8410c9e4ecb1f13a60c58f52d98db3.exe
PID 1728 wrote to memory of 5016	1728	2f8410c9e4ecb1f13a60c58f52d98db3.exe	2f8410c9e4ecb1f13a60c58f52d98db3.exe
PID 1728 wrote to memory of 5016	1728	2f8410c9e4ecb1f13a60c58f52d98db3.exe	2f8410c9e4ecb1f13a60c58f52d98db3.exe
PID 1728 wrote to memory of 5016	1728	2f8410c9e4ecb1f13a60c58f52d98db3.exe	2f8410c9e4ecb1f13a60c58f52d98db3.exe
PID 1728 wrote to memory of 5016	1728	2f8410c9e4ecb1f13a60c58f52d98db3.exe	2f8410c9e4ecb1f13a60c58f52d98db3.exe
PID 1728 wrote to memory of 5016	1728	2f8410c9e4ecb1f13a60c58f52d98db3.exe	2f8410c9e4ecb1f13a60c58f52d98db3.exe
PID 1728 wrote to memory of 5016	1728	2f8410c9e4ecb1f13a60c58f52d98db3.exe	2f8410c9e4ecb1f13a60c58f52d98db3.exe

C:\Users\Admin\AppData\Local\Temp\2f8410c9e4ecb1f13a60c58f52d98db3.exe
C:\Users\Admin\AppData\Local\Temp\2f8410c9e4ecb1f13a60c58f52d98db3.exe
2⤵
PID:4328

C:\Users\Admin\AppData\Local\Temp\2f8410c9e4ecb1f13a60c58f52d98db3.exe
C:\Users\Admin\AppData\Local\Temp\2f8410c9e4ecb1f13a60c58f52d98db3.exe
2⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 1572
3⤵
- Program crash
PID:3656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5016 -ip 5016
1⤵
PID:3916

memory/1728-6-0x0000000005680000-0x000000000568A000-memory.dmp

Filesize
40KB

Download
memory/1728-8-0x00000000059A0000-0x00000000059C8000-memory.dmp

Filesize
160KB

Download
memory/1728-2-0x0000000005A60000-0x0000000006004000-memory.dmp

Filesize
5.6MB

Download
memory/1728-3-0x00000000054B0000-0x0000000005542000-memory.dmp

Filesize
584KB

Download
memory/1728-4-0x0000000074EC0000-0x0000000075670000-memory.dmp

Filesize
7.7MB

Download
memory/1728-5-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/1728-1-0x00000000009E0000-0x0000000000AAE000-memory.dmp

Filesize
824KB

Download
memory/1728-7-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/1728-0-0x0000000074EC0000-0x0000000075670000-memory.dmp

Filesize
7.7MB

Download
memory/1728-14-0x0000000074EC0000-0x0000000075670000-memory.dmp

Filesize
7.7MB

Download
memory/5016-10-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/5016-12-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/5016-13-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/5016-9-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/5016-24-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download