vidar | fa7f5b950d340ec4da7c437fe32031f22985034130cec41e7fd7f55c80778f38

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 19:27

Target

ab292ca19cdf082ca574079c509ac729.exe
Size

750KB
MD5

ab292ca19cdf082ca574079c509ac729
SHA1

dedb710717bd0f77afb43b3e4d35c7a38d432ad0
SHA256

fa7f5b950d340ec4da7c437fe32031f22985034130cec41e7fd7f55c80778f38
SHA512

403bae833e8057a286b23ab9eaccc3be9e2d4eb295ebfd65af6d7bfbd9e8ef1d1e29015c80b13068806495e5979ef20f207fe6d76b3521bc02f7c0e80adeff89
SSDEEP

12288:tkBuS8FtXOsOr7tIShXIxy2CKrXbVExkSxOZuX86JY1oowOZ6XxAiVrjJgostV2a:trN0f7Sagy2TrXbV8kSs8XfeXv6T7YHP

Score

10^/10

vidar 921 stealer

Family

vidar

Version

39.8

Botnet

921

https://xeronxikxxx.tumblr.com/

Attributes

Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/116-6-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/116-8-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/116-10-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/116-5-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/116-20-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

ab292ca19cdf082ca574079c509ac729.exe

description pid process target process

PID 5088 set thread context of 116 5088 ab292ca19cdf082ca574079c509ac729.exe ab292ca19cdf082ca574079c509ac729.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2160 116 WerFault.exe ab292ca19cdf082ca574079c509ac729.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ab292ca19cdf082ca574079c509ac729.exe

description pid process

Token: SeDebugPrivilege 5088 ab292ca19cdf082ca574079c509ac729.exe

description	pid	process	target process
PID 5088 set thread context of 116	5088	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe

pid	pid_target	process	target process
2160	116	WerFault.exe	ab292ca19cdf082ca574079c509ac729.exe

description	pid	process
Token: SeDebugPrivilege	5088	ab292ca19cdf082ca574079c509ac729.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ab292ca19cdf082ca574079c509ac729.exe

description	pid	process	target process
PID 5088 wrote to memory of 116	5088	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 5088 wrote to memory of 116	5088	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 5088 wrote to memory of 116	5088	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 5088 wrote to memory of 116	5088	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 5088 wrote to memory of 116	5088	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 5088 wrote to memory of 116	5088	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 5088 wrote to memory of 116	5088	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe
PID 5088 wrote to memory of 116	5088	ab292ca19cdf082ca574079c509ac729.exe	ab292ca19cdf082ca574079c509ac729.exe

C:\Users\Admin\AppData\Local\Temp\ab292ca19cdf082ca574079c509ac729.exe
C:\Users\Admin\AppData\Local\Temp\ab292ca19cdf082ca574079c509ac729.exe
2⤵
PID:116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 1188
3⤵
- Program crash
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 116 -ip 116
1⤵
PID:1256

memory/116-6-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/116-8-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/116-10-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/116-5-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/116-20-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/5088-1-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/5088-0-0x0000000000100000-0x00000000001BE000-memory.dmp

Filesize
760KB

Download
memory/5088-3-0x0000000004A80000-0x0000000004A81000-memory.dmp

Filesize
4KB

Download
memory/5088-2-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/5088-4-0x0000000004BC0000-0x0000000004BE8000-memory.dmp

Filesize
160KB

Download
memory/5088-9-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download