vidar | e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582

Analysis

max time kernel
84s
max time network
152s
platform
windows10_x64
resource
win10v20210408
submitted
26-09-2021 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe
Size

1.5MB
MD5

ad2abd31423102dc67fc8bc207584e9b
SHA1

ddf00ff18ca8497a51f1c4bfb9e9ce18df131952
SHA256

e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582
SHA512

77e95e63c7fd6797595d700c05fa0ebb8cee0e30de25ea5c6f75e85a861922a13c9c4842dfcbaf9f1b3ff7872cdb09d7c641d46e3a0b458e258620aad4b4c093

Score

10^/10

vidar spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1544 created 4060 1544 WerFault.exe e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

description	pid	process	target process
PID 1544 created 4060	1544	WerFault.exe	e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/4060-115-0x0000000002AD0000-0x0000000002BEB000-memory.dmp	family_vidar
behavioral1/memory/4060-116-0x0000000000400000-0x000000000057E000-memory.dmp	family_vidar

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

Processes:

e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe

pid	process
4060	e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe
4060	e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Program crash 13 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3968	4060	WerFault.exe	e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe
3660	4060	WerFault.exe	e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe
4024	4060	WerFault.exe	e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe
3004	4060	WerFault.exe	e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe
3572	4060	WerFault.exe	e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe
3156	4060	WerFault.exe	e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe
768	4060	WerFault.exe	e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe
2248	4060	WerFault.exe	e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe
992	4060	WerFault.exe	e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe
904	4060	WerFault.exe	e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe
1132	4060	WerFault.exe	e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe
1296	4060	WerFault.exe	e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe
1544	4060	WerFault.exe	e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	process
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3572	WerFault.exe
3572	WerFault.exe
3572	WerFault.exe
3572	WerFault.exe
3572	WerFault.exe
3572	WerFault.exe
3572	WerFault.exe
3572	WerFault.exe
3572	WerFault.exe
3572	WerFault.exe
3572	WerFault.exe
3572	WerFault.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	pid	process
Token: SeRestorePrivilege	3968	WerFault.exe
Token: SeBackupPrivilege	3968	WerFault.exe
Token: SeDebugPrivilege	3968	WerFault.exe
Token: SeDebugPrivilege	3660	WerFault.exe
Token: SeDebugPrivilege	4024	WerFault.exe
Token: SeDebugPrivilege	3004	WerFault.exe
Token: SeDebugPrivilege	3572	WerFault.exe
Token: SeDebugPrivilege	3156	WerFault.exe
Token: SeDebugPrivilege	768	WerFault.exe
Token: SeDebugPrivilege	2248	WerFault.exe
Token: SeDebugPrivilege	992	WerFault.exe
Token: SeDebugPrivilege	904	WerFault.exe
Token: SeDebugPrivilege	1132	WerFault.exe
Token: SeDebugPrivilege	1296	WerFault.exe
Token: SeDebugPrivilege	1544	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe
"C:\Users\Admin\AppData\Local\Temp\e772feb82fbe1ae2d0a157d1c3911e25744f5877d508ec32536e03b0c59bc582.exe"
1⤵
- Loads dropped DLL
PID:4060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 920
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1044
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1068
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1500
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1712
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1732
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1496
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1768
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1812
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1728
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1828
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1784
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1496
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\mozglue.dll

MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll

MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
memory/4060-114-0x0000000000580000-0x000000000062E000-memory.dmp

Filesize
696KB

Download
memory/4060-115-0x0000000002AD0000-0x0000000002BEB000-memory.dmp

Filesize
1.1MB

Download
memory/4060-116-0x0000000000400000-0x000000000057E000-memory.dmp

Filesize
1.5MB

Download