vidar | 7ec5f24e6f59719e6c071ec719dcfcbe8e48f5293f493b903f19446c1815048b

Analysis

max time kernel
146s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 18:27

Target

0ce1142f9f77965a89851422bcbf840d_JaffaCakes118.exe
Size

743KB
MD5

0ce1142f9f77965a89851422bcbf840d
SHA1

9550e44f366f9d405d0b41007174ee4ed78d4994
SHA256

7ec5f24e6f59719e6c071ec719dcfcbe8e48f5293f493b903f19446c1815048b
SHA512

ed34886a9752c422681d6e962b986e511a1a02e21f3a0030db296fe1769af36b61b706ccf441495f49779cd417d78e52bd8dbcfa53951545b07020f2e288b3d7
SSDEEP

12288:m9tmXVlpMx6YXCJquD4EREx3/7bLP6Un5GBe3HmS++jCIoKsl7D+FYTrGg2OsrJL:JfpMxv44/x3Tb+o7j1oKsl7D+FY+7OsU

Score

10^/10

vidar 903 stealer

Family

vidar

Version

41.3

Botnet

903

https://mas.to/@oleg98

Attributes

Vidar Stealer 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2684-2-0x0000000002FD0000-0x00000000030A6000-memory.dmp	family_vidar
behavioral1/memory/2684-3-0x0000000000400000-0x000000000172D000-memory.dmp	family_vidar
behavioral1/memory/2684-19-0x0000000000400000-0x000000000172D000-memory.dmp	family_vidar
behavioral1/memory/2684-22-0x0000000002FD0000-0x00000000030A6000-memory.dmp	family_vidar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2584 2684 WerFault.exe 0ce1142f9f77965a89851422bcbf840d_JaffaCakes118.exe

pid	pid_target	process	target process
2584	2684	WerFault.exe	0ce1142f9f77965a89851422bcbf840d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0ce1142f9f77965a89851422bcbf840d_JaffaCakes118.exe

description	pid	process	target process
PID 2684 wrote to memory of 2584	2684	0ce1142f9f77965a89851422bcbf840d_JaffaCakes118.exe	WerFault.exe
PID 2684 wrote to memory of 2584	2684	0ce1142f9f77965a89851422bcbf840d_JaffaCakes118.exe	WerFault.exe
PID 2684 wrote to memory of 2584	2684	0ce1142f9f77965a89851422bcbf840d_JaffaCakes118.exe	WerFault.exe
PID 2684 wrote to memory of 2584	2684	0ce1142f9f77965a89851422bcbf840d_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0ce1142f9f77965a89851422bcbf840d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ce1142f9f77965a89851422bcbf840d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 688
2⤵
- Program crash
PID:2584

memory/2684-1-0x00000000018F0000-0x00000000019F0000-memory.dmp

Filesize
1024KB

Download
memory/2684-2-0x0000000002FD0000-0x00000000030A6000-memory.dmp

Filesize
856KB

Download
memory/2684-3-0x0000000000400000-0x000000000172D000-memory.dmp

Filesize
19.2MB

Download
memory/2684-19-0x0000000000400000-0x000000000172D000-memory.dmp

Filesize
19.2MB

Download
memory/2684-21-0x00000000018F0000-0x00000000019F0000-memory.dmp

Filesize
1024KB

Download
memory/2684-22-0x0000000002FD0000-0x00000000030A6000-memory.dmp

Filesize
856KB

Download