vidar | f75d6ee676e63208489f05cd8c82d44fdda74b5752963e3967071f2d2d080113

Analysis

max time kernel
155s
max time network
166s
platform
windows10_x64
resource
win10v20210408
submitted
24-09-2021 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Litever01.exe
Size

502KB
MD5

bca995c0fd475fb09fb7988cb876c795
SHA1

0f8776b9a5b3daedcc314fa283172697dee4cf8d
SHA256

659895bb642f43854043053d386b987c63db7e615d827dbc41866ac0371ab92d
SHA512

94387589151f5dc774aaf981988c8f6b568e8373158ce79b5da370594a6f67f18c5b90547da62db70a808a9756fc318eeb3cd6df9b87495bfde379a46e2699df

Score

10^/10

vidar 933 stealer

Malware Config

Extracted

Family

vidar

Version

40.1

Botnet

933

https://eduarroma.tumblr.com/

Attributes

profile_id
933

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 636 created 900 636 WerFault.exe Litever01.exe
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

description	pid	process	target process
PID 636 created 900	636	WerFault.exe	Litever01.exe

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral8/memory/900-115-0x0000000003C10000-0x0000000003CAD000-memory.dmp	family_vidar
behavioral8/memory/900-116-0x0000000000400000-0x0000000001DCA000-memory.dmp	family_vidar

Program crash 17 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2100	900	WerFault.exe	Litever01.exe
2716	900	WerFault.exe	Litever01.exe
3860	900	WerFault.exe	Litever01.exe
3108	900	WerFault.exe	Litever01.exe
3992	900	WerFault.exe	Litever01.exe
3948	900	WerFault.exe	Litever01.exe
3180	900	WerFault.exe	Litever01.exe
3636	900	WerFault.exe	Litever01.exe
2696	900	WerFault.exe	Litever01.exe
3460	900	WerFault.exe	Litever01.exe
3940	900	WerFault.exe	Litever01.exe
3768	900	WerFault.exe	Litever01.exe
1636	900	WerFault.exe	Litever01.exe
2168	900	WerFault.exe	Litever01.exe
3984	900	WerFault.exe	Litever01.exe
3832	900	WerFault.exe	Litever01.exe
636	900	WerFault.exe	Litever01.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Litever01.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Litever01.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Litever01.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	process
2100	WerFault.exe
2100	WerFault.exe
2100	WerFault.exe
2100	WerFault.exe
2100	WerFault.exe
2100	WerFault.exe
2100	WerFault.exe
2100	WerFault.exe
2100	WerFault.exe
2100	WerFault.exe
2100	WerFault.exe
2100	WerFault.exe
2100	WerFault.exe
2100	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3108	WerFault.exe
3108	WerFault.exe
3108	WerFault.exe
3108	WerFault.exe
3108	WerFault.exe
3108	WerFault.exe
3108	WerFault.exe
3108	WerFault.exe
3108	WerFault.exe
3108	WerFault.exe
3108	WerFault.exe
3108	WerFault.exe
3108	WerFault.exe
3108	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

description	pid	process
Token: SeRestorePrivilege	2100	WerFault.exe
Token: SeBackupPrivilege	2100	WerFault.exe
Token: SeDebugPrivilege	2100	WerFault.exe
Token: SeDebugPrivilege	2716	WerFault.exe
Token: SeDebugPrivilege	3860	WerFault.exe
Token: SeDebugPrivilege	3108	WerFault.exe
Token: SeDebugPrivilege	3992	WerFault.exe
Token: SeDebugPrivilege	3948	WerFault.exe
Token: SeDebugPrivilege	3180	WerFault.exe
Token: SeDebugPrivilege	3636	WerFault.exe
Token: SeDebugPrivilege	2696	WerFault.exe
Token: SeDebugPrivilege	3460	WerFault.exe
Token: SeDebugPrivilege	3940	WerFault.exe
Token: SeDebugPrivilege	3768	WerFault.exe
Token: SeDebugPrivilege	1636	WerFault.exe
Token: SeDebugPrivilege	2168	WerFault.exe
Token: SeDebugPrivilege	3984	WerFault.exe
Token: SeDebugPrivilege	3832	WerFault.exe
Token: SeDebugPrivilege	636	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Litever01.exe
"C:\Users\Admin\AppData\Local\Temp\Litever01.exe"
1⤵
- Modifies system certificate store
PID:900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 760
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 784
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 788
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 840
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 924
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 1120
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 1408
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 1616
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 1400
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 1552
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 1660
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 1700
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 1360
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 1636
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 1776
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 1552
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 880
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-115-0x0000000003C10000-0x0000000003CAD000-memory.dmp

Filesize
628KB

Download
memory/900-116-0x0000000000400000-0x0000000001DCA000-memory.dmp

Filesize
25.8MB

Download