vidar | f543bca03c8aab5bdf2f069ddaabda9f339db5f686a4b4275d7db32183c2655c

General

Target
5cc364f6e9779515c0c29d64bc17cd00.exe
Size 1.6MB
Sample210607-3egtsmbfge
SHA256 f543bca03c8aab5bdf2f069ddaabda9f339db5f686a4b4275d7db32183c2655c
MD5 5cc364f6e9779515c0c29d64bc17cd00
SHA1 67f7287cbe2326cf775d1c1b83f7bd28851827d1
SHA512 4f3b0c29d699d3ac84d3b22ac9bd14a5557715a262e58b8b58e5f4e7e8924ffb50e4add1c7fa641838ee12a17bd3075d9132c376725be21d7bc2446af01cf717
MD5 SHA1 SHA512

Score

10^/10

vidar 921 spyware stealer

Malware Config

Extracted

Family

vidar

Version

39.2

Botnet

921

C2

https://dimashub.tumblr.com

Attributes

profile_id
921

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/2812-130-0x0000000000400000-0x000000000049A000-memory.dmp	family_vidar
behavioral2/memory/2812-132-0x0000000000400000-0x000000000049A000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
3176	Queste.exe.com
2768	Queste.exe.com
2812	Queste.exe.com

Loads dropped DLL 2 IoCs

pid	Process
2812	Queste.exe.com
2812	Queste.exe.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2768 set thread context of 2812	2768	Queste.exe.com	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
212	2812	WerFault.exe	88
1860	2812	WerFault.exe	88

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4088	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Queste.exe.com
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Queste.exe.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3720	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2812	Queste.exe.com
2812	Queste.exe.com
2812	Queste.exe.com
2812	Queste.exe.com
2812	Queste.exe.com
2812	Queste.exe.com

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 2764	988	5cc364f6e9779515c0c29d64bc17cd00.exe	75
PID 988 wrote to memory of 2764	988	5cc364f6e9779515c0c29d64bc17cd00.exe	75
PID 988 wrote to memory of 2764	988	5cc364f6e9779515c0c29d64bc17cd00.exe	75
PID 2764 wrote to memory of 2880	2764	cmd.exe	77
PID 2764 wrote to memory of 2880	2764	cmd.exe	77
PID 2764 wrote to memory of 2880	2764	cmd.exe	77
PID 2880 wrote to memory of 2888	2880	cmd.exe	78
PID 2880 wrote to memory of 2888	2880	cmd.exe	78
PID 2880 wrote to memory of 2888	2880	cmd.exe	78
PID 2880 wrote to memory of 3176	2880	cmd.exe	79
PID 2880 wrote to memory of 3176	2880	cmd.exe	79
PID 2880 wrote to memory of 3176	2880	cmd.exe	79
PID 2880 wrote to memory of 3720	2880	cmd.exe	81
PID 2880 wrote to memory of 3720	2880	cmd.exe	81
PID 2880 wrote to memory of 3720	2880	cmd.exe	81
PID 3176 wrote to memory of 2768	3176	Queste.exe.com	82
PID 3176 wrote to memory of 2768	3176	Queste.exe.com	82
PID 3176 wrote to memory of 2768	3176	Queste.exe.com	82
PID 2768 wrote to memory of 4088	2768	Queste.exe.com	83
PID 2768 wrote to memory of 4088	2768	Queste.exe.com	83
PID 2768 wrote to memory of 4088	2768	Queste.exe.com	83
PID 2768 wrote to memory of 2812	2768	Queste.exe.com	88
PID 2768 wrote to memory of 2812	2768	Queste.exe.com	88
PID 2768 wrote to memory of 2812	2768	Queste.exe.com	88
PID 2768 wrote to memory of 2812	2768	Queste.exe.com	88
PID 2768 wrote to memory of 2812	2768	Queste.exe.com	88

C:\Users\Admin\AppData\Local\Temp\5cc364f6e9779515c0c29d64bc17cd00.exe
"C:\Users\Admin\AppData\Local\Temp\5cc364f6e9779515c0c29d64bc17cd00.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\cmd < Era.aspx
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^NNHYaszdCjSWmgxfkdACJznhpeKCfNYWutUdQzPQEzDOkZMyMdMKnGBzfzOfGRqOgVPcxtnRBKYfQJwpfFQYwhnmDAwvEA$" Bonta.aspx
      4⤵
      PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Queste.exe.com
      Queste.exe.com L
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Queste.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Queste.exe.com L
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2768
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "KDlHYOaQkq" /tr "C:\\Users\\Admin\\AppData\\Roaming\\JHSKFVbufu\\KDlHYOaQkq.exe.com C:\\Users\\Admin\\AppData\\Roaming\\JHSKFVbufu\\d" /sc onstart /F /RU SYSTEM
        6⤵
        Creates scheduled task(s)
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Queste.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Queste.exe.com
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:2812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 1652
        7⤵
        Program crash
        
        PID:212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 1632
        7⤵
        Program crash
        
        PID:1860
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 30
      4⤵
      Runs ping.exe
      PID:3720