vidar | e49fbe983f9657085fd6ed87ef01d3d80b8c89fc15e159e227e661c8a9f76704

Analysis

max time kernel
66s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 02:10

Target

e49fbe983f9657085fd6ed87ef01d3d80b8c89fc15e159e227e661c8a9f76704.exe
Size

393KB
MD5

b96f9d010e1c6150e78bd217212f2854
SHA1

c43a35a08db7358281d25a2f0134d41eb37a3ae8
SHA256

e49fbe983f9657085fd6ed87ef01d3d80b8c89fc15e159e227e661c8a9f76704
SHA512

956b90536bb9fa138854a1e47313219b117485708a20e110946682eff972a8e0ee396041b13b1cc03f103989f3029cf59e55ea0b17940ffd8be50dd3f4f2252d
SSDEEP

6144:nGVRPs+yOtDqvFTbTEw3A9YkXw44ExQF9K6H6E+gyVMjM20vK2Bss5YjP:8RPs+yOo2h9YExQW6HziMw2DGss2jP

Score

10^/10

vidar stealer

Family

vidar

https://steamcommunity.com/profiles/76561199677575543

https://t.me/snsb82

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Detect Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/2616-0-0x00000000003B0000-0x0000000000417000-memory.dmp	family_vidar_v7
behavioral2/memory/3948-1-0x0000000000400000-0x000000000064A000-memory.dmp	family_vidar_v7
behavioral2/memory/2616-3-0x00000000003B0000-0x0000000000417000-memory.dmp	family_vidar_v7
behavioral2/memory/3948-7-0x0000000000400000-0x000000000064A000-memory.dmp	family_vidar_v7
behavioral2/memory/3948-5-0x0000000000400000-0x000000000064A000-memory.dmp	family_vidar_v7

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2616-0-0x00000000003B0000-0x0000000000417000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/3948-1-0x0000000000400000-0x000000000064A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/2616-3-0x00000000003B0000-0x0000000000417000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/3948-7-0x0000000000400000-0x000000000064A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/3948-5-0x0000000000400000-0x000000000064A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Suspicious use of SetThreadContext 1 IoCs

Processes:

e49fbe983f9657085fd6ed87ef01d3d80b8c89fc15e159e227e661c8a9f76704.exe

description	pid	process	target process
PID 2616 set thread context of 3948	2616	e49fbe983f9657085fd6ed87ef01d3d80b8c89fc15e159e227e661c8a9f76704.exe	RegAsm.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2896 3948 WerFault.exe RegAsm.exe

pid	pid_target	process	target process
2896	3948	WerFault.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

e49fbe983f9657085fd6ed87ef01d3d80b8c89fc15e159e227e661c8a9f76704.exe

description	pid	process	target process
PID 2616 wrote to memory of 3948	2616	e49fbe983f9657085fd6ed87ef01d3d80b8c89fc15e159e227e661c8a9f76704.exe	RegAsm.exe
PID 2616 wrote to memory of 3948	2616	e49fbe983f9657085fd6ed87ef01d3d80b8c89fc15e159e227e661c8a9f76704.exe	RegAsm.exe
PID 2616 wrote to memory of 3948	2616	e49fbe983f9657085fd6ed87ef01d3d80b8c89fc15e159e227e661c8a9f76704.exe	RegAsm.exe
PID 2616 wrote to memory of 3948	2616	e49fbe983f9657085fd6ed87ef01d3d80b8c89fc15e159e227e661c8a9f76704.exe	RegAsm.exe
PID 2616 wrote to memory of 3948	2616	e49fbe983f9657085fd6ed87ef01d3d80b8c89fc15e159e227e661c8a9f76704.exe	RegAsm.exe
PID 2616 wrote to memory of 3948	2616	e49fbe983f9657085fd6ed87ef01d3d80b8c89fc15e159e227e661c8a9f76704.exe	RegAsm.exe
PID 2616 wrote to memory of 3948	2616	e49fbe983f9657085fd6ed87ef01d3d80b8c89fc15e159e227e661c8a9f76704.exe	RegAsm.exe
PID 2616 wrote to memory of 3948	2616	e49fbe983f9657085fd6ed87ef01d3d80b8c89fc15e159e227e661c8a9f76704.exe	RegAsm.exe
PID 2616 wrote to memory of 3948	2616	e49fbe983f9657085fd6ed87ef01d3d80b8c89fc15e159e227e661c8a9f76704.exe	RegAsm.exe
PID 2616 wrote to memory of 3948	2616	e49fbe983f9657085fd6ed87ef01d3d80b8c89fc15e159e227e661c8a9f76704.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 1472
3⤵
- Program crash
PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3948 -ip 3948
1⤵
PID:4852

memory/2616-0-0x00000000003B0000-0x0000000000417000-memory.dmp

Filesize
412KB

Download
memory/2616-3-0x00000000003B0000-0x0000000000417000-memory.dmp

Filesize
412KB

Download
memory/3948-1-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/3948-7-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download
memory/3948-5-0x0000000000400000-0x000000000064A000-memory.dmp

Filesize
2.3MB

Download