vidar | f3aca29ebe030327614bd9490d21337a76c99fc690da96143c778e949b4f3014

Analysis

max time kernel
75s
max time network
137s
platform
windows10_x64
resource
win10v20210408
submitted
05/09/2021, 21:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e82112809c0043643842b3b712d2faf2.exe
Size 679KB
Sample210905-z6rlwachgl
SHA256 f3aca29ebe030327614bd9490d21337a76c99fc690da96143c778e949b4f3014
MD5 e82112809c0043643842b3b712d2faf2
SHA1 7c02bcf16e1a0eaafa0297d0fd4cbdcc9c385e62
SHA512 d3c7280a044ae22f11e65a0ba6acac061251968fc32f54a79f0dfc90ea65227818e251419e27a3b2efebad1b7038f2a1e267a2d175702aa62c7aa31e30f5eadd
MD5 SHA1 SHA512

Score

10^/10

vidar 1008 spyware stealer

Malware Config

Extracted

Family

vidar

Version

40.4

Botnet

1008

https://romkaxarit.tumblr.com/

Attributes

profile_id
1008

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2388 created 652	2388	WerFault.exe	67

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/652-115-0x0000000000400000-0x00000000021C7000-memory.dmp	family_vidar

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
652	e82112809c0043643842b3b712d2faf2.exe
652	e82112809c0043643842b3b712d2faf2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Program crash 16 IoCs

pid	pid_target	Process	procid_target
3764	652	WerFault.exe	67
2952	652	WerFault.exe	67
3316	652	WerFault.exe	67
212	652	WerFault.exe	67
1964	652	WerFault.exe	67
3084	652	WerFault.exe	67
1184	652	WerFault.exe	67
2256	652	WerFault.exe	67
2340	652	WerFault.exe	67
3964	652	WerFault.exe	67
4048	652	WerFault.exe	67
3160	652	WerFault.exe	67
2324	652	WerFault.exe	67
2240	652	WerFault.exe	67
344	652	WerFault.exe	67
2388	652	WerFault.exe	67

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	e82112809c0043643842b3b712d2faf2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	e82112809c0043643842b3b712d2faf2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3764	WerFault.exe
3764	WerFault.exe
3764	WerFault.exe
3764	WerFault.exe
3764	WerFault.exe
3764	WerFault.exe
3764	WerFault.exe
3764	WerFault.exe
3764	WerFault.exe
3764	WerFault.exe
3764	WerFault.exe
3764	WerFault.exe
3764	WerFault.exe
3764	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
3316	WerFault.exe
3316	WerFault.exe
3316	WerFault.exe
3316	WerFault.exe
3316	WerFault.exe
3316	WerFault.exe
3316	WerFault.exe
3316	WerFault.exe
3316	WerFault.exe
3316	WerFault.exe
3316	WerFault.exe
3316	WerFault.exe
3316	WerFault.exe
3316	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeRestorePrivilege	3764	WerFault.exe
Token: SeBackupPrivilege	3764	WerFault.exe
Token: SeDebugPrivilege	3764	WerFault.exe
Token: SeDebugPrivilege	2952	WerFault.exe
Token: SeDebugPrivilege	3316	WerFault.exe
Token: SeDebugPrivilege	212	WerFault.exe
Token: SeDebugPrivilege	1964	WerFault.exe
Token: SeDebugPrivilege	3084	WerFault.exe
Token: SeDebugPrivilege	1184	WerFault.exe
Token: SeDebugPrivilege	2340	WerFault.exe
Token: SeDebugPrivilege	3964	WerFault.exe
Token: SeDebugPrivilege	4048	WerFault.exe
Token: SeDebugPrivilege	3160	WerFault.exe
Token: SeDebugPrivilege	2324	WerFault.exe
Token: SeDebugPrivilege	2240	WerFault.exe
Token: SeDebugPrivilege	344	WerFault.exe
Token: SeDebugPrivilege	2388	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e82112809c0043643842b3b712d2faf2.exe
"C:\Users\Admin\AppData\Local\Temp\e82112809c0043643842b3b712d2faf2.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
PID:652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 764
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 828
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 832
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 824
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 924
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 980
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 1408
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 1620
  2⤵
  - Program crash
  PID:2256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 1360
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 1660
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 1628
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:4048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 1704
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 1776
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 1736
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 1688
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 1568
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-114-0x0000000002270000-0x00000000023BA000-memory.dmp

Download

memory/652-115-0x0000000000400000-0x00000000021C7000-memory.dmp

Download