Vidar - AutoIt Process Injection via VirtualAllocEx (T1055)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•4

Detects AutoIt3.exe allocating memory with read, write, and execute (RWX) permissions into another process's space, which is indicative of a payload injection phase, specifically associated with the Vidar stealer loader.