General
Target

55c13fa59c8517e58164f51bb3b5cab7a28c88f82ba578df2f73795c9329b7a5.exe

Filesize

721KB

Completed

15-02-2022 13:20

Task

behavioral2

Score
10/10
MD5

09f01e9e875c7a1d76bb0817a07f0cac

SHA1

08760e083a332d50badc6bfc62a49deb5809e83d

SHA256

55c13fa59c8517e58164f51bb3b5cab7a28c88f82ba578df2f73795c9329b7a5

SHA256

4f53696dee4ded4ab71d7e3d4362b13b8508d4a79b2690782edfbd96b59053c2ead2b677bf9214b2ef489a1a3b96abbc9ec11fd447fd6d610b1cc71c5e6fee7f

Malware Config

Extracted

Family

vidar

Version

48.7

Botnet

937

C2

https://mstdn.social/@anapa

https://mastodon.social/@mniami

Attributes
profile_id
937
Signatures 4

Filter: none

  • Vidar

    Description

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/2704-132-0x0000000004830000-0x0000000004905000-memory.dmpfamily_vidar
    behavioral2/memory/2704-133-0x0000000000400000-0x00000000004D8000-memory.dmpfamily_vidar
  • Drops file in Windows directory
    svchost.exeTiWorker.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\DataStore.jfmsvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\ReportingEvents.logsvchost.exe
    File opened for modificationC:\Windows\Logs\CBS\CBS.logTiWorker.exe
    File opened for modificationC:\Windows\WinSxS\pending.xmlTiWorker.exe
    File opened for modificationC:\Windows\WindowsUpdate.logsvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\Logs\edb.chksvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\Logs\edb.logsvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\DataStore.edbsvchost.exe
  • Suspicious use of AdjustPrivilegeToken
    svchost.exeTiWorker.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeShutdownPrivilege2784svchost.exe
    Token: SeCreatePagefilePrivilege2784svchost.exe
    Token: SeShutdownPrivilege2784svchost.exe
    Token: SeCreatePagefilePrivilege2784svchost.exe
    Token: SeShutdownPrivilege2784svchost.exe
    Token: SeCreatePagefilePrivilege2784svchost.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
    Token: SeRestorePrivilege5040TiWorker.exe
    Token: SeSecurityPrivilege5040TiWorker.exe
    Token: SeBackupPrivilege5040TiWorker.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\55c13fa59c8517e58164f51bb3b5cab7a28c88f82ba578df2f73795c9329b7a5.exe
    "C:\Users\Admin\AppData\Local\Temp\55c13fa59c8517e58164f51bb3b5cab7a28c88f82ba578df2f73795c9329b7a5.exe"
    PID:2704
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    Drops file in Windows directory
    Suspicious use of AdjustPrivilegeToken
    PID:2784
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    Drops file in Windows directory
    Suspicious use of AdjustPrivilegeToken
    PID:5040
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/2704-130-0x0000000002DAD000-0x0000000002E29000-memory.dmp

                          • memory/2704-131-0x0000000002DAD000-0x0000000002E29000-memory.dmp

                          • memory/2704-132-0x0000000004830000-0x0000000004905000-memory.dmp

                          • memory/2704-133-0x0000000000400000-0x00000000004D8000-memory.dmp

                          • memory/2784-134-0x000001FF12F90000-0x000001FF12FA0000-memory.dmp

                          • memory/2784-135-0x000001FF13620000-0x000001FF13630000-memory.dmp

                          • memory/2784-136-0x000001FF15D10000-0x000001FF15D14000-memory.dmp