vidar | 4227ee74e68b799efeb3613493f4814a81e16fec32c88bcc3fdcc7eae35b60bc

Analysis

max time kernel
161s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2024 19:00

Target

f1e89356f7a21887e4b5db1160717abf.exe
Size

581KB
MD5

f1e89356f7a21887e4b5db1160717abf
SHA1

ff7409ec73309460650dccc2e44efb8595c246d7
SHA256

4227ee74e68b799efeb3613493f4814a81e16fec32c88bcc3fdcc7eae35b60bc
SHA512

891734162b8f4b5c1d9cc08cc9c8140edbdf8af2ca4b0819a860cc1c1887d041e25db1b4282069ebeea6d764846d5d20ba3e836d923b1e3886f468236b244e51
SSDEEP

12288:qxOZuX86JY1oowOZ6XxAiVrjJgostVjXl+2U9rKicYz:qs8XfeXv6T7YH7l+2GrKicYz

Score

10^/10

vidar 921 stealer

Family

vidar

Version

39.8

Botnet

921

https://xeronxikxxx.tumblr.com/

Attributes

Vidar Stealer 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/3276-8-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/3276-9-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/3276-12-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/3276-13-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

f1e89356f7a21887e4b5db1160717abf.exe

description pid process target process

PID 2056 set thread context of 3276 2056 f1e89356f7a21887e4b5db1160717abf.exe f1e89356f7a21887e4b5db1160717abf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f1e89356f7a21887e4b5db1160717abf.exe

description pid process

Token: SeDebugPrivilege 2056 f1e89356f7a21887e4b5db1160717abf.exe

description	pid	process	target process
PID 2056 set thread context of 3276	2056	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe

description	pid	process
Token: SeDebugPrivilege	2056	f1e89356f7a21887e4b5db1160717abf.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

f1e89356f7a21887e4b5db1160717abf.exe

description	pid	process	target process
PID 2056 wrote to memory of 1432	2056	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe
PID 2056 wrote to memory of 1432	2056	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe
PID 2056 wrote to memory of 1432	2056	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe
PID 2056 wrote to memory of 3276	2056	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe
PID 2056 wrote to memory of 3276	2056	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe
PID 2056 wrote to memory of 3276	2056	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe
PID 2056 wrote to memory of 3276	2056	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe
PID 2056 wrote to memory of 3276	2056	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe
PID 2056 wrote to memory of 3276	2056	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe
PID 2056 wrote to memory of 3276	2056	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe
PID 2056 wrote to memory of 3276	2056	f1e89356f7a21887e4b5db1160717abf.exe	f1e89356f7a21887e4b5db1160717abf.exe

C:\Users\Admin\AppData\Local\Temp\f1e89356f7a21887e4b5db1160717abf.exe
C:\Users\Admin\AppData\Local\Temp\f1e89356f7a21887e4b5db1160717abf.exe
2⤵
PID:1432

C:\Users\Admin\AppData\Local\Temp\f1e89356f7a21887e4b5db1160717abf.exe
C:\Users\Admin\AppData\Local\Temp\f1e89356f7a21887e4b5db1160717abf.exe
2⤵
PID:3276

memory/2056-6-0x00000000008D0000-0x0000000000946000-memory.dmp

Filesize
472KB

Download
memory/2056-1-0x0000000000070000-0x0000000000104000-memory.dmp

Filesize
592KB

Download
memory/2056-2-0x0000000074E00000-0x00000000755B0000-memory.dmp

Filesize
7.7MB

Download
memory/2056-3-0x0000000004B30000-0x0000000004B40000-memory.dmp

Filesize
64KB

Download
memory/2056-4-0x0000000004B30000-0x0000000004B40000-memory.dmp

Filesize
64KB

Download
memory/2056-5-0x0000000000780000-0x00000000007A0000-memory.dmp

Filesize
128KB

Download
memory/2056-0-0x0000000074E00000-0x00000000755B0000-memory.dmp

Filesize
7.7MB

Download
memory/2056-7-0x0000000000870000-0x000000000088E000-memory.dmp

Filesize
120KB

Download
memory/2056-11-0x0000000074E00000-0x00000000755B0000-memory.dmp

Filesize
7.7MB

Download
memory/3276-8-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3276-9-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3276-12-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3276-13-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download