vidar | ef3b48f619d531c43699dfdaa768c2be6b27eb77778700cffdec3cde0685cf1f

Analysis

max time kernel
156s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2024 12:23

Target

58e8612ccf7d25efd986141e6221a7c3.exe
Size

543KB
MD5

58e8612ccf7d25efd986141e6221a7c3
SHA1

d276b7fa97e6acbb825e209635d5b61ca08472c5
SHA256

ef3b48f619d531c43699dfdaa768c2be6b27eb77778700cffdec3cde0685cf1f
SHA512

7219ca6041c4a91c785dc98ebd12aa1ba3d0f0047f30ed0edf66600213483555dc8bf6a41614313620b3202479c3992750ffe6359a0057d125aed32cfa89fdc9
SSDEEP

12288:kMTcnxOZuX86JY1oowOZ6XxAiVrjJgostVtokiQl:kPs8XfeXv6T7YHtokiQl

Score

10^/10

vidar 921 stealer

Family

vidar

Version

39.8

Botnet

921

https://xeronxikxxx.tumblr.com/

Attributes

Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/1788-8-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/1788-10-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/1788-11-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/1788-13-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/1788-23-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

58e8612ccf7d25efd986141e6221a7c3.exe

description pid process target process

PID 4660 set thread context of 1788 4660 58e8612ccf7d25efd986141e6221a7c3.exe 58e8612ccf7d25efd986141e6221a7c3.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1636 1788 WerFault.exe 58e8612ccf7d25efd986141e6221a7c3.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

58e8612ccf7d25efd986141e6221a7c3.exe

description pid process

Token: SeDebugPrivilege 4660 58e8612ccf7d25efd986141e6221a7c3.exe

description	pid	process	target process
PID 4660 set thread context of 1788	4660	58e8612ccf7d25efd986141e6221a7c3.exe	58e8612ccf7d25efd986141e6221a7c3.exe

pid	pid_target	process	target process
1636	1788	WerFault.exe	58e8612ccf7d25efd986141e6221a7c3.exe

description	pid	process
Token: SeDebugPrivilege	4660	58e8612ccf7d25efd986141e6221a7c3.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

58e8612ccf7d25efd986141e6221a7c3.exe

description	pid	process	target process
PID 4660 wrote to memory of 1788	4660	58e8612ccf7d25efd986141e6221a7c3.exe	58e8612ccf7d25efd986141e6221a7c3.exe
PID 4660 wrote to memory of 1788	4660	58e8612ccf7d25efd986141e6221a7c3.exe	58e8612ccf7d25efd986141e6221a7c3.exe
PID 4660 wrote to memory of 1788	4660	58e8612ccf7d25efd986141e6221a7c3.exe	58e8612ccf7d25efd986141e6221a7c3.exe
PID 4660 wrote to memory of 1788	4660	58e8612ccf7d25efd986141e6221a7c3.exe	58e8612ccf7d25efd986141e6221a7c3.exe
PID 4660 wrote to memory of 1788	4660	58e8612ccf7d25efd986141e6221a7c3.exe	58e8612ccf7d25efd986141e6221a7c3.exe
PID 4660 wrote to memory of 1788	4660	58e8612ccf7d25efd986141e6221a7c3.exe	58e8612ccf7d25efd986141e6221a7c3.exe
PID 4660 wrote to memory of 1788	4660	58e8612ccf7d25efd986141e6221a7c3.exe	58e8612ccf7d25efd986141e6221a7c3.exe
PID 4660 wrote to memory of 1788	4660	58e8612ccf7d25efd986141e6221a7c3.exe	58e8612ccf7d25efd986141e6221a7c3.exe

C:\Users\Admin\AppData\Local\Temp\58e8612ccf7d25efd986141e6221a7c3.exe
C:\Users\Admin\AppData\Local\Temp\58e8612ccf7d25efd986141e6221a7c3.exe
2⤵
PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 1280
3⤵
- Program crash
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1788 -ip 1788
1⤵
PID:4384

memory/1788-8-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1788-23-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1788-13-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1788-11-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1788-10-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4660-3-0x0000000005490000-0x0000000005506000-memory.dmp

Filesize
472KB

Download
memory/4660-6-0x0000000005480000-0x0000000005490000-memory.dmp

Filesize
64KB

Download
memory/4660-7-0x00000000057D0000-0x00000000057E4000-memory.dmp

Filesize
80KB

Download
memory/4660-5-0x0000000005730000-0x000000000574E000-memory.dmp

Filesize
120KB

Download
memory/4660-4-0x0000000074D60000-0x0000000075510000-memory.dmp

Filesize
7.7MB

Download
memory/4660-12-0x0000000074D60000-0x0000000075510000-memory.dmp

Filesize
7.7MB

Download
memory/4660-0-0x0000000074D60000-0x0000000075510000-memory.dmp

Filesize
7.7MB

Download
memory/4660-2-0x0000000005480000-0x0000000005490000-memory.dmp

Filesize
64KB

Download
memory/4660-1-0x0000000000A20000-0x0000000000AAC000-memory.dmp

Filesize
560KB

Download