vidar | a0ac775ecbfa0ab3218e32b09a0d4fdcd82e7ceaa31241dc106c4fc77e9b5ddb

General

Target
CDC95F7C10CC944D1B9C48F551CAD3E0.exe
Size 3.6MB
Sample210419-wp6lbjma5a
SHA256 a0ac775ecbfa0ab3218e32b09a0d4fdcd82e7ceaa31241dc106c4fc77e9b5ddb
MD5 cdc95f7c10cc944d1b9c48f551cad3e0
SHA1 a93020433248c8e34b104922a0e0667609c700db
SHA512 bec7720af3a62ca4c6ae0cca1d009ba497f8e4452a68c64a9312784677fe26863434d89d17ec059ae0b887c0d0e1efc4fa91120ab33369879b1d68e2459dda02
MD5 SHA1 SHA512

Score

10^/10

vidar discovery spyware stealer

Malware Config

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Executes dropped EXE 2 IoCs

pid	Process
1284	bingoboom.exe
1316	bingoboom.exe

Loads dropped DLL 6 IoCs

pid	Process
484	CDC95F7C10CC944D1B9C48F551CAD3E0.exe
484	CDC95F7C10CC944D1B9C48F551CAD3E0.exe
1316	bingoboom.exe
1316	bingoboom.exe
1316	bingoboom.exe
1316	bingoboom.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1284 set thread context of 1316	1284	bingoboom.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bingoboom.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bingoboom.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1716	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
916	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	bingoboom.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	bingoboom.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1316	bingoboom.exe
1316	bingoboom.exe
1316	bingoboom.exe
1316	bingoboom.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	taskkill.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 1284	484	CDC95F7C10CC944D1B9C48F551CAD3E0.exe	28
PID 484 wrote to memory of 1284	484	CDC95F7C10CC944D1B9C48F551CAD3E0.exe	28
PID 484 wrote to memory of 1284	484	CDC95F7C10CC944D1B9C48F551CAD3E0.exe	28
PID 484 wrote to memory of 1284	484	CDC95F7C10CC944D1B9C48F551CAD3E0.exe	28
PID 1284 wrote to memory of 1316	1284	bingoboom.exe	29
PID 1284 wrote to memory of 1316	1284	bingoboom.exe	29
PID 1284 wrote to memory of 1316	1284	bingoboom.exe	29
PID 1284 wrote to memory of 1316	1284	bingoboom.exe	29
PID 1284 wrote to memory of 1316	1284	bingoboom.exe	29
PID 1284 wrote to memory of 1316	1284	bingoboom.exe	29
PID 1316 wrote to memory of 668	1316	bingoboom.exe	33
PID 1316 wrote to memory of 668	1316	bingoboom.exe	33
PID 1316 wrote to memory of 668	1316	bingoboom.exe	33
PID 1316 wrote to memory of 668	1316	bingoboom.exe	33
PID 668 wrote to memory of 916	668	cmd.exe	35
PID 668 wrote to memory of 916	668	cmd.exe	35
PID 668 wrote to memory of 916	668	cmd.exe	35
PID 668 wrote to memory of 916	668	cmd.exe	35
PID 668 wrote to memory of 1716	668	cmd.exe	37
PID 668 wrote to memory of 1716	668	cmd.exe	37
PID 668 wrote to memory of 1716	668	cmd.exe	37
PID 668 wrote to memory of 1716	668	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\CDC95F7C10CC944D1B9C48F551CAD3E0.exe
"C:\Users\Admin\AppData\Local\Temp\CDC95F7C10CC944D1B9C48F551CAD3E0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:484
- C:\Users\Admin\AppData\Roaming\BingoBooms\bingoboom.exe
  "C:\Users\Admin\AppData\Roaming\BingoBooms\bingoboom.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Users\Admin\AppData\Roaming\BingoBooms\bingoboom.exe
    "C:\Users\Admin\AppData\Roaming\BingoBooms\bingoboom.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im bingoboom.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Roaming\BingoBooms\bingoboom.exe" & del C:\ProgramData\*.dll & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:668
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im bingoboom.exe /f
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:916
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        5⤵
        Delays execution with timeout.exe
        
        PID:1716