vidar | c391048f55dd2b433a4154f643a615482841b66f5e77d97a16e2f571ba45e2fa

Analysis

max time kernel
145s
max time network
155s
platform
windows10_x64
resource
win10-en
submitted
07/09/2021, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd387a78b3e30fefb6cd3f6bd6420cc7.exe
Size 676KB
Sample210907-gr4zjsfbgp
SHA256 c391048f55dd2b433a4154f643a615482841b66f5e77d97a16e2f571ba45e2fa
MD5 bd387a78b3e30fefb6cd3f6bd6420cc7
SHA1 b64db06f3664fdcde9c2890db39fec906f7f3f3a
SHA512 46664b06f94a91d778d57e1e40e4fcb8b1b27c2a73b7bd27864bac4ea9c9efe34a1665c2e4c2f51f82f270d00d7d771f31674b909aff2dc9acf82b26944f5440
MD5 SHA1 SHA512

Score

10^/10

vidar 1008 stealer

Malware Config

Extracted

Family

vidar

Version

40.4

Botnet

1008

https://romkaxarit.tumblr.com/

Attributes

profile_id
1008

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/3996-115-0x0000000002460000-0x0000000002533000-memory.dmp	family_vidar
behavioral2/memory/3996-116-0x0000000000400000-0x00000000021C6000-memory.dmp	family_vidar

Program crash 17 IoCs

pid	pid_target	Process	procid_target
3608	3996	WerFault.exe	68
1120	3996	WerFault.exe	68
3800	3996	WerFault.exe	68
1840	3996	WerFault.exe	68
1128	3996	WerFault.exe	68
3868	3996	WerFault.exe	68
2332	3996	WerFault.exe	68
2768	3996	WerFault.exe	68
3496	3996	WerFault.exe	68
3240	3996	WerFault.exe	68
2052	3996	WerFault.exe	68
1800	3996	WerFault.exe	68
3892	3996	WerFault.exe	68
1756	3996	WerFault.exe	68
2592	3996	WerFault.exe	68
3884	3996	WerFault.exe	68
2184	3996	WerFault.exe	68

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	bd387a78b3e30fefb6cd3f6bd6420cc7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	bd387a78b3e30fefb6cd3f6bd6420cc7.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1128	WerFault.exe
1128	WerFault.exe
1128	WerFault.exe
1128	WerFault.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeRestorePrivilege	3608	WerFault.exe
Token: SeBackupPrivilege	3608	WerFault.exe
Token: SeDebugPrivilege	3608	WerFault.exe
Token: SeDebugPrivilege	1120	WerFault.exe
Token: SeDebugPrivilege	3800	WerFault.exe
Token: SeDebugPrivilege	1840	WerFault.exe
Token: SeDebugPrivilege	1128	WerFault.exe
Token: SeDebugPrivilege	3868	WerFault.exe
Token: SeDebugPrivilege	2332	WerFault.exe
Token: SeDebugPrivilege	2768	WerFault.exe
Token: SeDebugPrivilege	3496	WerFault.exe
Token: SeDebugPrivilege	3240	WerFault.exe
Token: SeDebugPrivilege	2052	WerFault.exe
Token: SeDebugPrivilege	1800	WerFault.exe
Token: SeDebugPrivilege	3892	WerFault.exe
Token: SeDebugPrivilege	1756	WerFault.exe
Token: SeDebugPrivilege	2592	WerFault.exe
Token: SeDebugPrivilege	3884	WerFault.exe
Token: SeDebugPrivilege	2184	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bd387a78b3e30fefb6cd3f6bd6420cc7.exe
"C:\Users\Admin\AppData\Local\Temp\bd387a78b3e30fefb6cd3f6bd6420cc7.exe"
1⤵
- Modifies system certificate store
PID:3996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 760
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 812
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 740
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 824
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 956
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 948
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 1400
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 1624
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 1660
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 1352
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 1328
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 1564
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 1376
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 1408
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 1596
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 1720
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 1356
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3996-115-0x0000000002460000-0x0000000002533000-memory.dmp

Download

memory/3996-116-0x0000000000400000-0x00000000021C6000-memory.dmp

Download