vidar | 598d944c8f0ef8d8536487bb9b62ff8fbf6758b37da5132e17fb31e07acddc65

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2024 20:20

Target

784d1f5c2ef013a0523ca0616f62698d.exe
Size

2.4MB
MD5

784d1f5c2ef013a0523ca0616f62698d
SHA1

e4c76b676705a8ffcecb6fc8a9c2424300c9bd6c
SHA256

598d944c8f0ef8d8536487bb9b62ff8fbf6758b37da5132e17fb31e07acddc65
SHA512

3d08427e5fa3bf1cc31d0e8b97564c977ae8ea74afb5c3b2d87e36c63213148a85d84cd4a6f4a3d694459a79474f370b9cd131469f6a57e6c6ff6683038d7998
SSDEEP

24576:6mxGB0x427UGZgDcF8B9JgQLsuJp+t/wF1FWQ70JKlXQPsnrjv/pbxH0LGn5LtpL:6H

Score

10^/10

vidar 921 stealer

Family

vidar

Version

40.1

Botnet

921

https://eduarroma.tumblr.com/

Attributes

Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/2380-7-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/2380-9-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/2380-6-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/2380-11-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/2380-21-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

784d1f5c2ef013a0523ca0616f62698d.exe

description pid process target process

PID 2496 set thread context of 2380 2496 784d1f5c2ef013a0523ca0616f62698d.exe 784d1f5c2ef013a0523ca0616f62698d.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2360 2380 WerFault.exe 784d1f5c2ef013a0523ca0616f62698d.exe

description	pid	process	target process
PID 2496 set thread context of 2380	2496	784d1f5c2ef013a0523ca0616f62698d.exe	784d1f5c2ef013a0523ca0616f62698d.exe

pid	pid_target	process	target process
2360	2380	WerFault.exe	784d1f5c2ef013a0523ca0616f62698d.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

784d1f5c2ef013a0523ca0616f62698d.exe

description	pid	process	target process
PID 2496 wrote to memory of 2380	2496	784d1f5c2ef013a0523ca0616f62698d.exe	784d1f5c2ef013a0523ca0616f62698d.exe
PID 2496 wrote to memory of 2380	2496	784d1f5c2ef013a0523ca0616f62698d.exe	784d1f5c2ef013a0523ca0616f62698d.exe
PID 2496 wrote to memory of 2380	2496	784d1f5c2ef013a0523ca0616f62698d.exe	784d1f5c2ef013a0523ca0616f62698d.exe
PID 2496 wrote to memory of 2380	2496	784d1f5c2ef013a0523ca0616f62698d.exe	784d1f5c2ef013a0523ca0616f62698d.exe
PID 2496 wrote to memory of 2380	2496	784d1f5c2ef013a0523ca0616f62698d.exe	784d1f5c2ef013a0523ca0616f62698d.exe
PID 2496 wrote to memory of 2380	2496	784d1f5c2ef013a0523ca0616f62698d.exe	784d1f5c2ef013a0523ca0616f62698d.exe
PID 2496 wrote to memory of 2380	2496	784d1f5c2ef013a0523ca0616f62698d.exe	784d1f5c2ef013a0523ca0616f62698d.exe
PID 2496 wrote to memory of 2380	2496	784d1f5c2ef013a0523ca0616f62698d.exe	784d1f5c2ef013a0523ca0616f62698d.exe

C:\Users\Admin\AppData\Local\Temp\784d1f5c2ef013a0523ca0616f62698d.exe
C:\Users\Admin\AppData\Local\Temp\784d1f5c2ef013a0523ca0616f62698d.exe
2⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 1716
3⤵
- Program crash
PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2380 -ip 2380
1⤵
PID:736

memory/2380-7-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2380-9-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2380-6-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2380-11-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2380-21-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2496-1-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/2496-0-0x00000000000E0000-0x0000000000344000-memory.dmp

Filesize
2.4MB

Download
memory/2496-2-0x0000000004CC0000-0x0000000004D36000-memory.dmp

Filesize
472KB

Download
memory/2496-3-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/2496-4-0x0000000004C60000-0x0000000004C7E000-memory.dmp

Filesize
120KB

Download
memory/2496-5-0x0000000005530000-0x0000000005AD4000-memory.dmp

Filesize
5.6MB

Download
memory/2496-10-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download