General
Target

1ddaf1428fbb50f5ca15d0bd22c778c3589161d51a77791f0aa645a8dd9e9191.exe

Filesize

734KB

Completed

12-02-2022 11:13

Task

behavioral2

Score
10/10
MD5

3f5c3438e86329ed834cf51c85606c4d

SHA1

10d9c1ce923238976037299149eceb06c31e90c4

SHA256

1ddaf1428fbb50f5ca15d0bd22c778c3589161d51a77791f0aa645a8dd9e9191

SHA256

72d0aaa941f46b8fc7ea8f8e75f70b4e41af7079dc13053600a0937ca695d59a9a7276df9f3080f9605456312fd485a869aad37692441628102a2899a2c8ebab

Malware Config

Extracted

Family

vidar

Version

49.1

Botnet

937

C2

https://noc.social/@sergeev46

https://c.im/@sergeev47

Attributes
profile_id
937
Signatures 4

Filter: none

  • Vidar

    Description

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/3008-132-0x0000000002350000-0x0000000002429000-memory.dmpfamily_vidar
    behavioral2/memory/3008-133-0x0000000000400000-0x00000000004DD000-memory.dmpfamily_vidar
  • Drops file in Windows directory
    svchost.exeTiWorker.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\Logs\edb.logsvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\DataStore.edbsvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\DataStore.jfmsvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\ReportingEvents.logsvchost.exe
    File opened for modificationC:\Windows\Logs\CBS\CBS.logTiWorker.exe
    File opened for modificationC:\Windows\WinSxS\pending.xmlTiWorker.exe
    File opened for modificationC:\Windows\WindowsUpdate.logsvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\Logs\edb.chksvchost.exe
  • Suspicious use of AdjustPrivilegeToken
    svchost.exeTiWorker.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeShutdownPrivilege3240svchost.exe
    Token: SeCreatePagefilePrivilege3240svchost.exe
    Token: SeShutdownPrivilege3240svchost.exe
    Token: SeCreatePagefilePrivilege3240svchost.exe
    Token: SeShutdownPrivilege3240svchost.exe
    Token: SeCreatePagefilePrivilege3240svchost.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
    Token: SeRestorePrivilege4012TiWorker.exe
    Token: SeSecurityPrivilege4012TiWorker.exe
    Token: SeBackupPrivilege4012TiWorker.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\1ddaf1428fbb50f5ca15d0bd22c778c3589161d51a77791f0aa645a8dd9e9191.exe
    "C:\Users\Admin\AppData\Local\Temp\1ddaf1428fbb50f5ca15d0bd22c778c3589161d51a77791f0aa645a8dd9e9191.exe"
    PID:3008
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    Drops file in Windows directory
    Suspicious use of AdjustPrivilegeToken
    PID:3240
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    Drops file in Windows directory
    Suspicious use of AdjustPrivilegeToken
    PID:4012
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/3008-130-0x00000000005E8000-0x0000000000665000-memory.dmp

                          • memory/3008-131-0x00000000005E8000-0x0000000000665000-memory.dmp

                          • memory/3008-132-0x0000000002350000-0x0000000002429000-memory.dmp

                          • memory/3008-133-0x0000000000400000-0x00000000004DD000-memory.dmp

                          • memory/3240-134-0x000001E90AF30000-0x000001E90AF40000-memory.dmp

                          • memory/3240-135-0x000001E90AF90000-0x000001E90AFA0000-memory.dmp

                          • memory/3240-136-0x000001E90DC70000-0x000001E90DC74000-memory.dmp