General
Target

32057fad31bfb5015fc818847d245cd144a3c8166ae377cc4143ee5795ac06e5.exe

Filesize

655KB

Completed

15-02-2022 14:33

Task

behavioral2

Score
10/10
MD5

5214689cb18baecfe0267940ad845398

SHA1

919514c68f7e009ddbb523fc17bbb2ba5604cac4

SHA256

32057fad31bfb5015fc818847d245cd144a3c8166ae377cc4143ee5795ac06e5

SHA512

a2b18ac30bf332c5f473b48f6a570013dc9e8ec51ed212032253226d620a7b8018a05d018d8a0eea32e51ad5382b2b519d54da6bdebab8bae5f72664e8f500b9

Malware Config

Extracted

Family

vidar

Version

48.1

Botnet

937

C2

https://koyu.space/@rspich

Attributes
profile_id
937
Signatures 10

Filter: none

Discovery
  • Suspicious use of NtCreateProcessExOtherParentProcess
    WerFault.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1744 created 12121744WerFault.exe32057fad31bfb5015fc818847d245cd144a3c8166ae377cc4143ee5795ac06e5.exe
  • Vidar

    Description

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/1212-135-0x0000000000400000-0x00000000004D8000-memory.dmpfamily_vidar
    behavioral2/memory/1212-134-0x00000000021C0000-0x0000000002295000-memory.dmpfamily_vidar
  • Drops file in Windows directory
    svchost.exeTiWorker.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\Logs\edb.logsvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\DataStore.edbsvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\DataStore.jfmsvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\ReportingEvents.logsvchost.exe
    File opened for modificationC:\Windows\Logs\CBS\CBS.logTiWorker.exe
    File opened for modificationC:\Windows\WinSxS\pending.xmlTiWorker.exe
    File opened for modificationC:\Windows\WindowsUpdate.logsvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\Logs\edb.chksvchost.exe
  • Program crash
    WerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    19561212WerFault.exe32057fad31bfb5015fc818847d245cd144a3c8166ae377cc4143ee5795ac06e5.exe
  • Checks processor information in registry
    WerFault.exe

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0WerFault.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzWerFault.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameStringWerFault.exe
  • Enumerates system info in registry
    WerFault.exe

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\BIOSWerFault.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKUWerFault.exe
  • Suspicious behavior: EnumeratesProcesses
    WerFault.exe

    Reported IOCs

    pidprocess
    1956WerFault.exe
    1956WerFault.exe
  • Suspicious use of AdjustPrivilegeToken
    svchost.exeWerFault.exeTiWorker.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeShutdownPrivilege1952svchost.exe
    Token: SeCreatePagefilePrivilege1952svchost.exe
    Token: SeShutdownPrivilege1952svchost.exe
    Token: SeCreatePagefilePrivilege1952svchost.exe
    Token: SeRestorePrivilege1956WerFault.exe
    Token: SeBackupPrivilege1956WerFault.exe
    Token: SeShutdownPrivilege1952svchost.exe
    Token: SeCreatePagefilePrivilege1952svchost.exe
    Token: SeSecurityPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
    Token: SeSecurityPrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
    Token: SeSecurityPrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
    Token: SeSecurityPrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
    Token: SeSecurityPrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
    Token: SeSecurityPrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
    Token: SeSecurityPrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
    Token: SeSecurityPrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
    Token: SeSecurityPrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
    Token: SeSecurityPrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
    Token: SeSecurityPrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
    Token: SeSecurityPrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
    Token: SeSecurityPrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
    Token: SeSecurityPrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
    Token: SeSecurityPrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
    Token: SeSecurityPrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
    Token: SeSecurityPrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
    Token: SeSecurityPrivilege1600TiWorker.exe
    Token: SeBackupPrivilege1600TiWorker.exe
    Token: SeRestorePrivilege1600TiWorker.exe
  • Suspicious use of WriteProcessMemory
    WerFault.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1744 wrote to memory of 12121744WerFault.exe32057fad31bfb5015fc818847d245cd144a3c8166ae377cc4143ee5795ac06e5.exe
    PID 1744 wrote to memory of 12121744WerFault.exe32057fad31bfb5015fc818847d245cd144a3c8166ae377cc4143ee5795ac06e5.exe
Processes 5
  • C:\Users\Admin\AppData\Local\Temp\32057fad31bfb5015fc818847d245cd144a3c8166ae377cc4143ee5795ac06e5.exe
    "C:\Users\Admin\AppData\Local\Temp\32057fad31bfb5015fc818847d245cd144a3c8166ae377cc4143ee5795ac06e5.exe"
    PID:1212
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 1040
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1956
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1212 -ip 1212
    Suspicious use of NtCreateProcessExOtherParentProcess
    Suspicious use of WriteProcessMemory
    PID:1744
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    Drops file in Windows directory
    Suspicious use of AdjustPrivilegeToken
    PID:1952
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    Drops file in Windows directory
    Suspicious use of AdjustPrivilegeToken
    PID:1600
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • memory/1212-133-0x00000000020D0000-0x000000000214B000-memory.dmp

                        • memory/1212-135-0x0000000000400000-0x00000000004D8000-memory.dmp

                        • memory/1212-134-0x00000000021C0000-0x0000000002295000-memory.dmp

                        • memory/1952-136-0x0000011E2BC20000-0x0000011E2BC30000-memory.dmp

                        • memory/1952-137-0x0000011E2BC80000-0x0000011E2BC90000-memory.dmp

                        • memory/1952-138-0x0000011E2E330000-0x0000011E2E334000-memory.dmp