stealc | 45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:09

Target

45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a.exe
Size

147.8MB
MD5

7ed20e00327c9c34d9d2d4419a933fe1
SHA1

6e05b701929d46678188bf26b2fce7257327c90f
SHA256

45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a
SHA512

6fd0a0148f919a15b0b0c9e88820185c833f256a272373d659f54d3813b530b4ba3fc4bda979bae1797f59f3920cf36c44001fdcc3731f7c78d8140638d3b29e
SSDEEP

786432:adyRHF1WRkXOzGbY55kQshmSBaNf6rhoiu6wyiz23ku4Z8GG:adyxTWRkXGGE55XArKiu/yOlhG

Score

10^/10

Detect Vidar Stealer 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/3664-3-0x0000019DC21D0000-0x0000019DC2202000-memory.dmp	family_vidar_v7

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a.exe

description	pid	process	target process
PID 3572 wrote to memory of 3664	3572	45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a.exe	cmd.exe
PID 3572 wrote to memory of 3664	3572	45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a.exe	cmd.exe
PID 3572 wrote to memory of 3664	3572	45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a.exe
"C:\Users\Admin\AppData\Local\Temp\45086613ddc7a850802de51ddd4a5c8425fb1067d528007a7dbb62bb7479f55a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3572

memory/3664-3-0x0000019DC21D0000-0x0000019DC2202000-memory.dmp

Filesize
200KB

Download