vidar | 5a226e5207d7ea2c0e14abb068268a55bc974bdfe17181f6982b92a0a7fedcf2

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 11:16

Target

c5bc645f578d60725e7c38b3ef9c8352.exe
Size

500KB
MD5

c5bc645f578d60725e7c38b3ef9c8352
SHA1

c1933c1befcd21acc807991c2d0de2e3637988b5
SHA256

5a226e5207d7ea2c0e14abb068268a55bc974bdfe17181f6982b92a0a7fedcf2
SHA512

9c07208f081f828becc0091232e908a7efa744647541f599d874e22a8b1b0a5297d4044c201996809af6fb17836bc2c0dc91671a528083f213a8b0202fffd1d6
SSDEEP

12288:xcgBxxOZuX86JY1oowOZ6XxAiVrjJgostVHUdG:1s8XfeXv6T7YH0dG

Score

10^/10

vidar 921 stealer

Family

vidar

Version

39.8

Botnet

921

https://xeronxikxxx.tumblr.com/

Attributes

Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/1164-7-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/1164-8-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/1164-10-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/1164-11-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/1164-22-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Suspicious use of SetThreadContext 1 IoCs

Processes:

c5bc645f578d60725e7c38b3ef9c8352.exe

description pid process target process

PID 1652 set thread context of 1164 1652 c5bc645f578d60725e7c38b3ef9c8352.exe c5bc645f578d60725e7c38b3ef9c8352.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4828 1164 WerFault.exe c5bc645f578d60725e7c38b3ef9c8352.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c5bc645f578d60725e7c38b3ef9c8352.exe

description pid process

Token: SeDebugPrivilege 1652 c5bc645f578d60725e7c38b3ef9c8352.exe

description	pid	process	target process
PID 1652 set thread context of 1164	1652	c5bc645f578d60725e7c38b3ef9c8352.exe	c5bc645f578d60725e7c38b3ef9c8352.exe

pid	pid_target	process	target process
4828	1164	WerFault.exe	c5bc645f578d60725e7c38b3ef9c8352.exe

description	pid	process
Token: SeDebugPrivilege	1652	c5bc645f578d60725e7c38b3ef9c8352.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c5bc645f578d60725e7c38b3ef9c8352.exe

description	pid	process	target process
PID 1652 wrote to memory of 1164	1652	c5bc645f578d60725e7c38b3ef9c8352.exe	c5bc645f578d60725e7c38b3ef9c8352.exe
PID 1652 wrote to memory of 1164	1652	c5bc645f578d60725e7c38b3ef9c8352.exe	c5bc645f578d60725e7c38b3ef9c8352.exe
PID 1652 wrote to memory of 1164	1652	c5bc645f578d60725e7c38b3ef9c8352.exe	c5bc645f578d60725e7c38b3ef9c8352.exe
PID 1652 wrote to memory of 1164	1652	c5bc645f578d60725e7c38b3ef9c8352.exe	c5bc645f578d60725e7c38b3ef9c8352.exe
PID 1652 wrote to memory of 1164	1652	c5bc645f578d60725e7c38b3ef9c8352.exe	c5bc645f578d60725e7c38b3ef9c8352.exe
PID 1652 wrote to memory of 1164	1652	c5bc645f578d60725e7c38b3ef9c8352.exe	c5bc645f578d60725e7c38b3ef9c8352.exe
PID 1652 wrote to memory of 1164	1652	c5bc645f578d60725e7c38b3ef9c8352.exe	c5bc645f578d60725e7c38b3ef9c8352.exe
PID 1652 wrote to memory of 1164	1652	c5bc645f578d60725e7c38b3ef9c8352.exe	c5bc645f578d60725e7c38b3ef9c8352.exe

C:\Users\Admin\AppData\Local\Temp\c5bc645f578d60725e7c38b3ef9c8352.exe
C:\Users\Admin\AppData\Local\Temp\c5bc645f578d60725e7c38b3ef9c8352.exe
2⤵
PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 1740
3⤵
- Program crash
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1164 -ip 1164
1⤵
PID:4580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:1124

memory/1164-7-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1164-22-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1164-11-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1164-10-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1164-8-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1652-3-0x00000000052C0000-0x00000000052D0000-memory.dmp

Filesize
64KB

Download
memory/1652-6-0x00000000051E0000-0x00000000051FE000-memory.dmp

Filesize
120KB

Download
memory/1652-5-0x0000000005210000-0x0000000005286000-memory.dmp

Filesize
472KB

Download
memory/1652-4-0x0000000002D20000-0x0000000002D34000-memory.dmp

Filesize
80KB

Download
memory/1652-0-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/1652-2-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/1652-12-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/1652-1-0x0000000000790000-0x0000000000810000-memory.dmp

Filesize
512KB

Download