vidar | 3d466f3d0710f015571b152ebf917cd057e540dd7c954d04e9e89f7ebc3851b9

General

Target

198a59b9bc4b0f64b0d59fd40d182e68.exe
Size

700KB
MD5

198a59b9bc4b0f64b0d59fd40d182e68
SHA1

3dec5a926d068f094a78d282b710a65803b16488
SHA256

3d466f3d0710f015571b152ebf917cd057e540dd7c954d04e9e89f7ebc3851b9
SHA512

223db08c5e77a837b967ee30853e4528caa759fbfe25a7464dba85f74e3b7ce63e62e6a2aacf352ea55ae6f481b0d6c3afe63fab7481bedb2d1af06d49b0624a
SSDEEP

12288:BgF52s0BhP2PFro43nQMmo4RRNc0g+W2rQeQlAFB5co2DthtZmDjaq:BJscQPFc8HTWK0g+W2rlB503L6jaq

Score

10^/10

vidar 921 spyware stealer

Malware Config

Extracted

Family

vidar

Version

39.9

Botnet

921

C2

https://prophefliloc.tumblr.com/

Attributes

profile_id
921

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/4992-7-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4992-9-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4992-10-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4992-12-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4992-66-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

198a59b9bc4b0f64b0d59fd40d182e68.exe

description pid process target process

PID 4104 set thread context of 4992 4104 198a59b9bc4b0f64b0d59fd40d182e68.exe 198a59b9bc4b0f64b0d59fd40d182e68.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4204 4992 WerFault.exe 198a59b9bc4b0f64b0d59fd40d182e68.exe

description	pid	process	target process
PID 4104 set thread context of 4992	4104	198a59b9bc4b0f64b0d59fd40d182e68.exe	198a59b9bc4b0f64b0d59fd40d182e68.exe

pid	pid_target	process	target process
4204	4992	WerFault.exe	198a59b9bc4b0f64b0d59fd40d182e68.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

198a59b9bc4b0f64b0d59fd40d182e68.exe

pid	process
4992	198a59b9bc4b0f64b0d59fd40d182e68.exe
4992	198a59b9bc4b0f64b0d59fd40d182e68.exe
4992	198a59b9bc4b0f64b0d59fd40d182e68.exe
4992	198a59b9bc4b0f64b0d59fd40d182e68.exe
4992	198a59b9bc4b0f64b0d59fd40d182e68.exe
4992	198a59b9bc4b0f64b0d59fd40d182e68.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

198a59b9bc4b0f64b0d59fd40d182e68.exe

description pid process

Token: SeDebugPrivilege 4104 198a59b9bc4b0f64b0d59fd40d182e68.exe

description	pid	process
Token: SeDebugPrivilege	4104	198a59b9bc4b0f64b0d59fd40d182e68.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

198a59b9bc4b0f64b0d59fd40d182e68.exe

description	pid	process	target process
PID 4104 wrote to memory of 4992	4104	198a59b9bc4b0f64b0d59fd40d182e68.exe	198a59b9bc4b0f64b0d59fd40d182e68.exe
PID 4104 wrote to memory of 4992	4104	198a59b9bc4b0f64b0d59fd40d182e68.exe	198a59b9bc4b0f64b0d59fd40d182e68.exe
PID 4104 wrote to memory of 4992	4104	198a59b9bc4b0f64b0d59fd40d182e68.exe	198a59b9bc4b0f64b0d59fd40d182e68.exe
PID 4104 wrote to memory of 4992	4104	198a59b9bc4b0f64b0d59fd40d182e68.exe	198a59b9bc4b0f64b0d59fd40d182e68.exe
PID 4104 wrote to memory of 4992	4104	198a59b9bc4b0f64b0d59fd40d182e68.exe	198a59b9bc4b0f64b0d59fd40d182e68.exe
PID 4104 wrote to memory of 4992	4104	198a59b9bc4b0f64b0d59fd40d182e68.exe	198a59b9bc4b0f64b0d59fd40d182e68.exe
PID 4104 wrote to memory of 4992	4104	198a59b9bc4b0f64b0d59fd40d182e68.exe	198a59b9bc4b0f64b0d59fd40d182e68.exe
PID 4104 wrote to memory of 4992	4104	198a59b9bc4b0f64b0d59fd40d182e68.exe	198a59b9bc4b0f64b0d59fd40d182e68.exe

C:\Users\Admin\AppData\Local\Temp\198a59b9bc4b0f64b0d59fd40d182e68.exe
"C:\Users\Admin\AppData\Local\Temp\198a59b9bc4b0f64b0d59fd40d182e68.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4104

C:\Users\Admin\AppData\Local\Temp\198a59b9bc4b0f64b0d59fd40d182e68.exe
C:\Users\Admin\AppData\Local\Temp\198a59b9bc4b0f64b0d59fd40d182e68.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1748
3⤵
- Program crash
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4992 -ip 4992
1⤵
PID:2084

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4104-6-0x00000000051A0000-0x00000000051C6000-memory.dmp

Filesize
152KB

Download
memory/4104-1-0x00000000752C0000-0x0000000075A70000-memory.dmp

Filesize
7.7MB

Download
memory/4104-3-0x0000000004FA0000-0x0000000005032000-memory.dmp

Filesize
584KB

Download
memory/4104-2-0x0000000005550000-0x0000000005AF4000-memory.dmp

Filesize
5.6MB

Download
memory/4104-4-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download
memory/4104-5-0x0000000004F30000-0x0000000004F3A000-memory.dmp

Filesize
40KB

Download
memory/4104-0-0x00000000005C0000-0x0000000000672000-memory.dmp

Filesize
712KB

Download
memory/4104-11-0x00000000752C0000-0x0000000075A70000-memory.dmp

Filesize
7.7MB

Download
memory/4992-7-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4992-9-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4992-10-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4992-12-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4992-66-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads