General
Target

f69a9cd55b6d88040a40f092ae962eccad79c773afb156eeec5919fd11ca7174.exe

Filesize

772KB

Completed

15-02-2022 04:43

Task

behavioral2

Score
10/10
MD5

9e8388274066861ecf159c212e153ec1

SHA1

6ba52b3cca249625bce6de2fdf98002b7f476cde

SHA256

f69a9cd55b6d88040a40f092ae962eccad79c773afb156eeec5919fd11ca7174

SHA512

33a2a84cde6543aa464f4439d7db57e7debe6c87b7537b2b349da843b015b99cbd1d5dc70b347a6e8fcfa000652669cabc2e539748a5e127fdea72673915618c

Malware Config

Extracted

Family

vidar

Version

47.9

Botnet

937

C2

https://mas.to/@kirpich

Attributes
profile_id
937
Signatures 10

Filter: none

Discovery
  • Suspicious use of NtCreateProcessExOtherParentProcess
    WerFault.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4968 created 38164968WerFault.exef69a9cd55b6d88040a40f092ae962eccad79c773afb156eeec5919fd11ca7174.exe
  • Vidar

    Description

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/3816-132-0x00000000026F0000-0x00000000027C6000-memory.dmpfamily_vidar
    behavioral2/memory/3816-133-0x0000000000400000-0x00000000004D9000-memory.dmpfamily_vidar
  • Drops file in Windows directory
    TiWorker.exesvchost.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\WinSxS\pending.xmlTiWorker.exe
    File opened for modificationC:\Windows\WindowsUpdate.logsvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\Logs\edb.chksvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\Logs\edb.logsvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\DataStore.edbsvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\DataStore.jfmsvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\ReportingEvents.logsvchost.exe
    File opened for modificationC:\Windows\Logs\CBS\CBS.logTiWorker.exe
  • Program crash
    WerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    49643816WerFault.exef69a9cd55b6d88040a40f092ae962eccad79c773afb156eeec5919fd11ca7174.exe
  • Checks processor information in registry
    WerFault.exe

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0WerFault.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzWerFault.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameStringWerFault.exe
  • Enumerates system info in registry
    WerFault.exe

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKUWerFault.exe
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\BIOSWerFault.exe
  • Suspicious behavior: EnumeratesProcesses
    WerFault.exe

    Reported IOCs

    pidprocess
    4964WerFault.exe
    4964WerFault.exe
  • Suspicious use of AdjustPrivilegeToken
    WerFault.exesvchost.exeTiWorker.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeRestorePrivilege4964WerFault.exe
    Token: SeBackupPrivilege4964WerFault.exe
    Token: SeShutdownPrivilege4056svchost.exe
    Token: SeCreatePagefilePrivilege4056svchost.exe
    Token: SeShutdownPrivilege4056svchost.exe
    Token: SeCreatePagefilePrivilege4056svchost.exe
    Token: SeShutdownPrivilege4056svchost.exe
    Token: SeCreatePagefilePrivilege4056svchost.exe
    Token: SeSecurityPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
    Token: SeSecurityPrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
    Token: SeSecurityPrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
    Token: SeSecurityPrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
    Token: SeSecurityPrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
    Token: SeSecurityPrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
    Token: SeSecurityPrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
    Token: SeSecurityPrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
    Token: SeSecurityPrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
    Token: SeSecurityPrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
    Token: SeSecurityPrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
    Token: SeSecurityPrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
    Token: SeSecurityPrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
    Token: SeSecurityPrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
    Token: SeSecurityPrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
    Token: SeSecurityPrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
    Token: SeSecurityPrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
    Token: SeSecurityPrivilege3608TiWorker.exe
    Token: SeBackupPrivilege3608TiWorker.exe
    Token: SeRestorePrivilege3608TiWorker.exe
  • Suspicious use of WriteProcessMemory
    WerFault.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4968 wrote to memory of 38164968WerFault.exef69a9cd55b6d88040a40f092ae962eccad79c773afb156eeec5919fd11ca7174.exe
    PID 4968 wrote to memory of 38164968WerFault.exef69a9cd55b6d88040a40f092ae962eccad79c773afb156eeec5919fd11ca7174.exe
Processes 5
  • C:\Users\Admin\AppData\Local\Temp\f69a9cd55b6d88040a40f092ae962eccad79c773afb156eeec5919fd11ca7174.exe
    "C:\Users\Admin\AppData\Local\Temp\f69a9cd55b6d88040a40f092ae962eccad79c773afb156eeec5919fd11ca7174.exe"
    PID:3816
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 1028
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4964
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3816 -ip 3816
    Suspicious use of NtCreateProcessExOtherParentProcess
    Suspicious use of WriteProcessMemory
    PID:4968
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    Drops file in Windows directory
    Suspicious use of AdjustPrivilegeToken
    PID:4056
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    Drops file in Windows directory
    Suspicious use of AdjustPrivilegeToken
    PID:3608
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • memory/3816-130-0x0000000000B3D000-0x0000000000BB9000-memory.dmp

                        • memory/3816-131-0x0000000000B3D000-0x0000000000BB9000-memory.dmp

                        • memory/3816-132-0x00000000026F0000-0x00000000027C6000-memory.dmp

                        • memory/3816-133-0x0000000000400000-0x00000000004D9000-memory.dmp

                        • memory/4056-134-0x000001644B720000-0x000001644B730000-memory.dmp

                        • memory/4056-135-0x000001644B780000-0x000001644B790000-memory.dmp

                        • memory/4056-136-0x000001644DE40000-0x000001644DE44000-memory.dmp