558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe

General
Target

558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe

Filesize

1MB

Completed

26-09-2021 12:39

Score
10 /10
MD5

5df91194e2d3fd9f5f84f9b03e9f5b0e

SHA1

7f383ef4bde2cead4593885894035e230ab4f944

SHA256

558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe

Malware Config
Signatures 10

Filter: none

Collection
Credential Access
  • Suspicious use of NtCreateProcessExOtherParentProcess
    WerFault.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1544 created 17841544WerFault.exe558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe
  • Vidar

    Description

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1784-117-0x0000000000400000-0x000000000057E000-memory.dmpfamily_vidar
    behavioral1/memory/1784-116-0x0000000002B10000-0x0000000002C2B000-memory.dmpfamily_vidar
  • Downloads MZ/PE file
  • Loads dropped DLL
    558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe

    Reported IOCs

    pidprocess
    1784558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe
    1784558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Accesses 2FA software files, possible credential harvesting

    TTPs

    Data from Local SystemCredentials in Files
  • Program crash
    WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    26041784WerFault.exe558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe
    30481784WerFault.exe558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe
    34801784WerFault.exe558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe
    30001784WerFault.exe558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe
    5321784WerFault.exe558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe
    21081784WerFault.exe558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe
    18881784WerFault.exe558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe
    13361784WerFault.exe558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe
    6601784WerFault.exe558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe
    19721784WerFault.exe558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe
    30761784WerFault.exe558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe
    15441784WerFault.exe558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe
  • Suspicious behavior: EnumeratesProcesses
    WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

    Reported IOCs

    pidprocess
    2604WerFault.exe
    2604WerFault.exe
    2604WerFault.exe
    2604WerFault.exe
    2604WerFault.exe
    2604WerFault.exe
    2604WerFault.exe
    2604WerFault.exe
    2604WerFault.exe
    2604WerFault.exe
    2604WerFault.exe
    2604WerFault.exe
    2604WerFault.exe
    2604WerFault.exe
    3048WerFault.exe
    3048WerFault.exe
    3048WerFault.exe
    3048WerFault.exe
    3048WerFault.exe
    3048WerFault.exe
    3048WerFault.exe
    3048WerFault.exe
    3048WerFault.exe
    3048WerFault.exe
    3048WerFault.exe
    3048WerFault.exe
    3048WerFault.exe
    3048WerFault.exe
    3480WerFault.exe
    3480WerFault.exe
    3480WerFault.exe
    3480WerFault.exe
    3480WerFault.exe
    3480WerFault.exe
    3480WerFault.exe
    3480WerFault.exe
    3480WerFault.exe
    3480WerFault.exe
    3480WerFault.exe
    3480WerFault.exe
    3480WerFault.exe
    3480WerFault.exe
    3000WerFault.exe
    3000WerFault.exe
    3000WerFault.exe
    3000WerFault.exe
    3000WerFault.exe
    3000WerFault.exe
    3000WerFault.exe
    3000WerFault.exe
    3000WerFault.exe
    3000WerFault.exe
    3000WerFault.exe
    3000WerFault.exe
    3000WerFault.exe
    3000WerFault.exe
    532WerFault.exe
    532WerFault.exe
    532WerFault.exe
    532WerFault.exe
    532WerFault.exe
    532WerFault.exe
    532WerFault.exe
    532WerFault.exe
  • Suspicious use of AdjustPrivilegeToken
    WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeRestorePrivilege2604WerFault.exe
    Token: SeBackupPrivilege2604WerFault.exe
    Token: SeDebugPrivilege2604WerFault.exe
    Token: SeDebugPrivilege3048WerFault.exe
    Token: SeDebugPrivilege3480WerFault.exe
    Token: SeDebugPrivilege3000WerFault.exe
    Token: SeDebugPrivilege532WerFault.exe
    Token: SeDebugPrivilege2108WerFault.exe
    Token: SeDebugPrivilege1888WerFault.exe
    Token: SeDebugPrivilege1336WerFault.exe
    Token: SeDebugPrivilege660WerFault.exe
    Token: SeDebugPrivilege1972WerFault.exe
    Token: SeDebugPrivilege3076WerFault.exe
    Token: SeDebugPrivilege1544WerFault.exe
Processes 13
  • C:\Users\Admin\AppData\Local\Temp\558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe
    "C:\Users\Admin\AppData\Local\Temp\558c64e8360f1b7b57bb6e46718ee2cb0fb83f6f336031e9432e03efbb1927fe.exe"
    Loads dropped DLL
    PID:1784
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 952
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2604
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1056
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3048
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1100
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3480
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1492
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3000
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1712
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:532
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1720
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:2108
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1772
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:1888
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1412
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:1336
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1656
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:660
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1840
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:1972
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1868
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3076
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1948
      Suspicious use of NtCreateProcessExOtherParentProcess
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:1544
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • \ProgramData\mozglue.dll

                        MD5

                        8f73c08a9660691143661bf7332c3c27

                        SHA1

                        37fa65dd737c50fda710fdbde89e51374d0c204a

                        SHA256

                        3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                        SHA512

                        0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                      • \ProgramData\nss3.dll

                        MD5

                        bfac4e3c5908856ba17d41edcd455a51

                        SHA1

                        8eec7e888767aa9e4cca8ff246eb2aacb9170428

                        SHA256

                        e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                        SHA512

                        2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                      • memory/1784-115-0x0000000000630000-0x0000000000631000-memory.dmp

                      • memory/1784-117-0x0000000000400000-0x000000000057E000-memory.dmp

                      • memory/1784-116-0x0000000002B10000-0x0000000002C2B000-memory.dmp