Analysis

  • max time kernel
    169s
  • max time network
    179s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    15-02-2022 13:30

General

  • Target

    4ed7609cbb86ea0b7607b8a002e7f85b316903c3b6801240c9576aae8b3052ff.exe

  • Size

    618KB

  • MD5

    353a21b3835ac7c17a82af79302d23cc

  • SHA1

    03e96fc686cc15a0bb26186ecb4fe63e6b841c4b

  • SHA256

    4ed7609cbb86ea0b7607b8a002e7f85b316903c3b6801240c9576aae8b3052ff

  • SHA512

    fccacf9a70f9151f081caa6c2d32c2cee3fb3e3c95ce10ee5c632f3007f54c5513b024fc10c9abc9eb9c7703e197360d569040ec3e47d182a123079cba0743dc

Score
10/10

Malware Config

Extracted

Family

vidar

Version

41.7

Botnet

937

C2

https://mas.to/@lenka51

Attributes
profile_id
937

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess ⋅ 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer ⋅ 2 IoCs
  • Drops file in Windows directory ⋅ 4 IoCs
  • Program crash ⋅ 1 IoCs
  • Checks processor information in registry ⋅ 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry ⋅ 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS ⋅ 49 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 2 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 64 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ed7609cbb86ea0b7607b8a002e7f85b316903c3b6801240c9576aae8b3052ff.exe
    "C:\Users\Admin\AppData\Local\Temp\4ed7609cbb86ea0b7607b8a002e7f85b316903c3b6801240c9576aae8b3052ff.exe"
    PID:3408
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 1040
      Drops file in Windows directory
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:3544
  • C:\Windows\system32\MusNotifyIcon.exe
    %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
    Checks processor information in registry
    PID:364
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p
    Drops file in Windows directory
    Modifies data under HKEY_USERS
    PID:3244
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    Drops file in Windows directory
    Suspicious use of AdjustPrivilegeToken
    PID:3516
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3408 -ip 3408
    Suspicious use of NtCreateProcessExOtherParentProcess
    Suspicious use of WriteProcessMemory
    PID:1576

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • memory/3408-130-0x0000000002210000-0x000000000228C000-memory.dmp
                        • memory/3408-131-0x00000000022A0000-0x0000000002376000-memory.dmp
                        • memory/3408-132-0x0000000000400000-0x00000000004D9000-memory.dmp