vidar | 3114d9a19def58cc62a9b5dbe78360e64772b46e1815c974f318cafb99eedc98

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2024 07:38

Target

55de04a0c8bb1e49015b62988c835b9a.exe
Size

693KB
MD5

55de04a0c8bb1e49015b62988c835b9a
SHA1

6a91271deff3f90359e95cafb722f1d9db7f80f3
SHA256

3114d9a19def58cc62a9b5dbe78360e64772b46e1815c974f318cafb99eedc98
SHA512

f723a33d5e2ba14c45aa30b83887d2f9690266a736f3201cebcdc986b7d4f7a97458f05bbe4eb74e363f964bcb66dad230bc195328493cc387f4733d22f7b11a
SSDEEP

12288:ity5w2s0BhP2PFro43nQMmo4RRNc0g+W2rQeQlAMPGII1RMXF93SVRvVNQxXU:i0TscQPFc8HTWK0g+W2rSGmfCVVVNQxk

Score

10^/10

vidar 921 stealer

Family

vidar

Version

39.9

Botnet

921

https://prophefliloc.tumblr.com/

Attributes

Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/4548-9-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4548-10-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4548-11-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4548-13-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4548-24-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

55de04a0c8bb1e49015b62988c835b9a.exe

description pid process target process

PID 516 set thread context of 4548 516 55de04a0c8bb1e49015b62988c835b9a.exe 55de04a0c8bb1e49015b62988c835b9a.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

55de04a0c8bb1e49015b62988c835b9a.exe

description pid process

Token: SeDebugPrivilege 516 55de04a0c8bb1e49015b62988c835b9a.exe

description	pid	process	target process
PID 516 set thread context of 4548	516	55de04a0c8bb1e49015b62988c835b9a.exe	55de04a0c8bb1e49015b62988c835b9a.exe

description	pid	process
Token: SeDebugPrivilege	516	55de04a0c8bb1e49015b62988c835b9a.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

55de04a0c8bb1e49015b62988c835b9a.exe

description	pid	process	target process
PID 516 wrote to memory of 4548	516	55de04a0c8bb1e49015b62988c835b9a.exe	55de04a0c8bb1e49015b62988c835b9a.exe
PID 516 wrote to memory of 4548	516	55de04a0c8bb1e49015b62988c835b9a.exe	55de04a0c8bb1e49015b62988c835b9a.exe
PID 516 wrote to memory of 4548	516	55de04a0c8bb1e49015b62988c835b9a.exe	55de04a0c8bb1e49015b62988c835b9a.exe
PID 516 wrote to memory of 4548	516	55de04a0c8bb1e49015b62988c835b9a.exe	55de04a0c8bb1e49015b62988c835b9a.exe
PID 516 wrote to memory of 4548	516	55de04a0c8bb1e49015b62988c835b9a.exe	55de04a0c8bb1e49015b62988c835b9a.exe
PID 516 wrote to memory of 4548	516	55de04a0c8bb1e49015b62988c835b9a.exe	55de04a0c8bb1e49015b62988c835b9a.exe
PID 516 wrote to memory of 4548	516	55de04a0c8bb1e49015b62988c835b9a.exe	55de04a0c8bb1e49015b62988c835b9a.exe
PID 516 wrote to memory of 4548	516	55de04a0c8bb1e49015b62988c835b9a.exe	55de04a0c8bb1e49015b62988c835b9a.exe

C:\Users\Admin\AppData\Local\Temp\55de04a0c8bb1e49015b62988c835b9a.exe
C:\Users\Admin\AppData\Local\Temp\55de04a0c8bb1e49015b62988c835b9a.exe
2⤵
PID:4548

memory/516-6-0x0000000074BA0000-0x0000000075350000-memory.dmp

Filesize
7.7MB

Download
memory/516-8-0x0000000005960000-0x0000000005986000-memory.dmp

Filesize
152KB

Download
memory/516-2-0x0000000005A80000-0x0000000006024000-memory.dmp

Filesize
5.6MB

Download
memory/516-3-0x00000000054D0000-0x0000000005562000-memory.dmp

Filesize
584KB

Download
memory/516-4-0x00000000056E0000-0x00000000056F0000-memory.dmp

Filesize
64KB

Download
memory/516-5-0x0000000005460000-0x000000000546A000-memory.dmp

Filesize
40KB

Download
memory/516-1-0x00000000009C0000-0x0000000000A70000-memory.dmp

Filesize
704KB

Download
memory/516-7-0x00000000056E0000-0x00000000056F0000-memory.dmp

Filesize
64KB

Download
memory/516-0-0x0000000074BA0000-0x0000000075350000-memory.dmp

Filesize
7.7MB

Download
memory/516-14-0x0000000074BA0000-0x0000000075350000-memory.dmp

Filesize
7.7MB

Download
memory/4548-10-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4548-11-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4548-13-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4548-9-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4548-24-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download