vidar | c658bfe194e75bd08503d48891fb59ec72b5d08bd1162f4f57be36327de0284f

Analysis

max time kernel
89s
max time network
149s
platform
windows10_x64
resource
win10-en
submitted
08/09/2021, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4514836b15d8dbac4ffc73bab6dd2fb.exe
Size 601KB
Sample210908-q2ebbaeee4
SHA256 c658bfe194e75bd08503d48891fb59ec72b5d08bd1162f4f57be36327de0284f
MD5 b4514836b15d8dbac4ffc73bab6dd2fb
SHA1 be0c5641610b3f075fcea3f2c7f8e678d2eb21c0
SHA512 999b49b4a5a39781e05aa821a0e212abf449babe183eed39aa42d517e80abe3ae362b2458973748afb6e117fa243c8ca31ae8317a40b54326698405230f8fb2b
MD5 SHA1 SHA512

Score

10^/10

vidar 1008 stealer

Malware Config

Extracted

Family

vidar

Version

40.4

Botnet

1008

https://romkaxarit.tumblr.com/

Attributes

profile_id
1008

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3828 created 4000	3828	WerFault.exe	68

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/4000-115-0x00000000022C0000-0x000000000240A000-memory.dmp	family_vidar
behavioral2/memory/4000-116-0x0000000000400000-0x00000000021B4000-memory.dmp	family_vidar

Program crash 17 IoCs

pid	pid_target	Process	procid_target
432	4000	WerFault.exe	68
3332	4000	WerFault.exe	68
3604	4000	WerFault.exe	68
2164	4000	WerFault.exe	68
4064	4000	WerFault.exe	68
3880	4000	WerFault.exe	68
1256	4000	WerFault.exe	68
2360	4000	WerFault.exe	68
1276	4000	WerFault.exe	68
2080	4000	WerFault.exe	68
1460	4000	WerFault.exe	68
1780	4000	WerFault.exe	68
2076	4000	WerFault.exe	68
3808	4000	WerFault.exe	68
4068	4000	WerFault.exe	68
3860	4000	WerFault.exe	68
3828	4000	WerFault.exe	68

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	b4514836b15d8dbac4ffc73bab6dd2fb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	b4514836b15d8dbac4ffc73bab6dd2fb.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
432	WerFault.exe
432	WerFault.exe
432	WerFault.exe
432	WerFault.exe
432	WerFault.exe
432	WerFault.exe
432	WerFault.exe
432	WerFault.exe
432	WerFault.exe
432	WerFault.exe
432	WerFault.exe
432	WerFault.exe
432	WerFault.exe
432	WerFault.exe
432	WerFault.exe
3332	WerFault.exe
3332	WerFault.exe
3332	WerFault.exe
3332	WerFault.exe
3332	WerFault.exe
3332	WerFault.exe
3332	WerFault.exe
3332	WerFault.exe
3332	WerFault.exe
3332	WerFault.exe
3332	WerFault.exe
3332	WerFault.exe
3332	WerFault.exe
3332	WerFault.exe
3332	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeRestorePrivilege	432	WerFault.exe
Token: SeBackupPrivilege	432	WerFault.exe
Token: SeDebugPrivilege	432	WerFault.exe
Token: SeDebugPrivilege	3332	WerFault.exe
Token: SeDebugPrivilege	3604	WerFault.exe
Token: SeDebugPrivilege	2164	WerFault.exe
Token: SeDebugPrivilege	4064	WerFault.exe
Token: SeDebugPrivilege	3880	WerFault.exe
Token: SeDebugPrivilege	1256	WerFault.exe
Token: SeDebugPrivilege	2360	WerFault.exe
Token: SeDebugPrivilege	1276	WerFault.exe
Token: SeDebugPrivilege	2080	WerFault.exe
Token: SeDebugPrivilege	1460	WerFault.exe
Token: SeDebugPrivilege	1780	WerFault.exe
Token: SeDebugPrivilege	2076	WerFault.exe
Token: SeDebugPrivilege	3808	WerFault.exe
Token: SeDebugPrivilege	4068	WerFault.exe
Token: SeDebugPrivilege	3860	WerFault.exe
Token: SeDebugPrivilege	3828	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b4514836b15d8dbac4ffc73bab6dd2fb.exe
"C:\Users\Admin\AppData\Local\Temp\b4514836b15d8dbac4ffc73bab6dd2fb.exe"
1⤵
- Modifies system certificate store
PID:4000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 760
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 812
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 816
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 856
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 956
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 1088
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 1464
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 1460
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 1456
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 1668
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 1688
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 1724
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 1688
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 1760
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 1800
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:4068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 1612
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 1748
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4000-115-0x00000000022C0000-0x000000000240A000-memory.dmp

Download

memory/4000-116-0x0000000000400000-0x00000000021B4000-memory.dmp

Download