vidar | aec939deb139f7f80a4e618f076ed2fe80d7f2bed77ba59336b1fd0470a0d7fa

Analysis

max time kernel
9s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 12:35

Target

4e5179eec2634bdfabe616fee23790ed.exe
Size

665KB
MD5

4e5179eec2634bdfabe616fee23790ed
SHA1

b2dc1c249b271c8dbd87d9a54d8fbb5a6158dc25
SHA256

aec939deb139f7f80a4e618f076ed2fe80d7f2bed77ba59336b1fd0470a0d7fa
SHA512

329d13890afbf7cc64f61bbee39ebd9a1b1fda2065ee6e0f9d54adcdcb27a27db16d5143c21c71d0b141b8c207b3061b83670411c0eee196b9a3a98770682441
SSDEEP

12288:Qm5XCDJXxwcfU98GHWp8De2VQKVncHsoJSt1U5bSOT4v9cgjCc0sYnxnVW:edXxwMp8fVQKZcHzJSnMbSCgj3Yne

Score

10^/10

vidar 828 stealer

Family

vidar

Version

39.7

Botnet

828

https://shpak125.tumblr.com/

Attributes

Vidar Stealer 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/756-3-0x0000000000400000-0x00000000004C2000-memory.dmp	family_vidar
behavioral1/memory/756-2-0x00000000002C0000-0x000000000035D000-memory.dmp	family_vidar
behavioral1/memory/756-14-0x0000000000400000-0x00000000004C2000-memory.dmp	family_vidar
behavioral1/memory/756-49-0x00000000002C0000-0x000000000035D000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2872 756 WerFault.exe 4e5179eec2634bdfabe616fee23790ed.exe

pid	pid_target	process	target process
2872	756	WerFault.exe	4e5179eec2634bdfabe616fee23790ed.exe

C:\Users\Admin\AppData\Local\Temp\4e5179eec2634bdfabe616fee23790ed.exe
"C:\Users\Admin\AppData\Local\Temp\4e5179eec2634bdfabe616fee23790ed.exe"
1⤵
PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 880
2⤵
- Program crash
PID:2872

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3B41.tmp
Filesize
17KB

MD5
2a69a1f9404ee2f300421e12fe0ca5a5

SHA1
74b1166dfcd1a856cdd7bdfae9db67a6cd4c2e7f

SHA256
db12b5ea4a67d73812e65ad474af65d40c769e84ada09c2db144da719eb2d220

SHA512
43f486cf23eca5dbe80075e04ca26b074e68396034a206da30c52cf37ee3cc9b79dfd3089d676afdbecd38b055e71520eb302b14f7741261c051e714fd599e08

Download Submit
memory/756-3-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/756-2-0x00000000002C0000-0x000000000035D000-memory.dmp

Filesize
628KB

Download
memory/756-1-0x0000000000560000-0x0000000000660000-memory.dmp

Filesize
1024KB

Download
memory/756-14-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/756-44-0x0000000000560000-0x0000000000660000-memory.dmp

Filesize
1024KB

Download
memory/756-49-0x00000000002C0000-0x000000000035D000-memory.dmp

Filesize
628KB

Download