vidar | 0a798e054fbe8545d4e1df781f3bb1a45b2fc58b5fb8d1c7383be8980aea829a

General

Target
66bde9ddd0fb80ac7309176c23d03804.exe
Size 611KB
Sample210715-4vcxrrq2s2
SHA256 0a798e054fbe8545d4e1df781f3bb1a45b2fc58b5fb8d1c7383be8980aea829a
MD5 66bde9ddd0fb80ac7309176c23d03804
SHA1 45cd868973bac9c1808efdf19fd88dfd742cf7b4
SHA512 65089ca60de87ee1557ac907bfac2f14d02ef55d3d687c9fb4b0628dcb35f32ae9507c1eebb435f079a0b3ca19ea635a77ebc3dbc24ffc8032d23e291cc36b03
MD5 SHA1 SHA512

Score

10^/10

vidar 517 discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

39.6

Botnet

517

C2

https://sslamlssa1.tumblr.com/

Attributes

profile_id
517

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral2/memory/3192-114-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/3192-115-0x000000000046B76D-mapping.dmp	family_vidar
behavioral2/memory/628-116-0x0000000002830000-0x00000000028CE000-memory.dmp	family_vidar
behavioral2/memory/3192-117-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
3192	66bde9ddd0fb80ac7309176c23d03804.exe
3192	66bde9ddd0fb80ac7309176c23d03804.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 628 set thread context of 3192	628	66bde9ddd0fb80ac7309176c23d03804.exe	75

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	66bde9ddd0fb80ac7309176c23d03804.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	66bde9ddd0fb80ac7309176c23d03804.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4064	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1320	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	66bde9ddd0fb80ac7309176c23d03804.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	66bde9ddd0fb80ac7309176c23d03804.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3192	66bde9ddd0fb80ac7309176c23d03804.exe
3192	66bde9ddd0fb80ac7309176c23d03804.exe
3192	66bde9ddd0fb80ac7309176c23d03804.exe
3192	66bde9ddd0fb80ac7309176c23d03804.exe
3192	66bde9ddd0fb80ac7309176c23d03804.exe
3192	66bde9ddd0fb80ac7309176c23d03804.exe
3192	66bde9ddd0fb80ac7309176c23d03804.exe
3192	66bde9ddd0fb80ac7309176c23d03804.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	taskkill.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 3192	628	66bde9ddd0fb80ac7309176c23d03804.exe	75
PID 628 wrote to memory of 3192	628	66bde9ddd0fb80ac7309176c23d03804.exe	75
PID 628 wrote to memory of 3192	628	66bde9ddd0fb80ac7309176c23d03804.exe	75
PID 628 wrote to memory of 3192	628	66bde9ddd0fb80ac7309176c23d03804.exe	75
PID 628 wrote to memory of 3192	628	66bde9ddd0fb80ac7309176c23d03804.exe	75
PID 628 wrote to memory of 3192	628	66bde9ddd0fb80ac7309176c23d03804.exe	75
PID 628 wrote to memory of 3192	628	66bde9ddd0fb80ac7309176c23d03804.exe	75
PID 628 wrote to memory of 3192	628	66bde9ddd0fb80ac7309176c23d03804.exe	75
PID 3192 wrote to memory of 1324	3192	66bde9ddd0fb80ac7309176c23d03804.exe	78
PID 3192 wrote to memory of 1324	3192	66bde9ddd0fb80ac7309176c23d03804.exe	78
PID 3192 wrote to memory of 1324	3192	66bde9ddd0fb80ac7309176c23d03804.exe	78
PID 1324 wrote to memory of 1320	1324	cmd.exe	80
PID 1324 wrote to memory of 1320	1324	cmd.exe	80
PID 1324 wrote to memory of 1320	1324	cmd.exe	80
PID 1324 wrote to memory of 4064	1324	cmd.exe	82
PID 1324 wrote to memory of 4064	1324	cmd.exe	82
PID 1324 wrote to memory of 4064	1324	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\66bde9ddd0fb80ac7309176c23d03804.exe
"C:\Users\Admin\AppData\Local\Temp\66bde9ddd0fb80ac7309176c23d03804.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:628
- C:\Users\Admin\AppData\Local\Temp\66bde9ddd0fb80ac7309176c23d03804.exe
  "C:\Users\Admin\AppData\Local\Temp\66bde9ddd0fb80ac7309176c23d03804.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im 66bde9ddd0fb80ac7309176c23d03804.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\66bde9ddd0fb80ac7309176c23d03804.exe" & del C:\ProgramData\*.dll & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im 66bde9ddd0fb80ac7309176c23d03804.exe /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1320
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:4064