vidar | 29f281cac20928673a516da70a1495cf217aea2dc386d7719de2df7c2053fb9d

General

Target

90761d7a9ac41a9602b7094663921f42.exe
Size

5.0MB
MD5

90761d7a9ac41a9602b7094663921f42
SHA1

eb2357f00f922719f261a97ca1f4350a7c3d168a
SHA256

29f281cac20928673a516da70a1495cf217aea2dc386d7719de2df7c2053fb9d
SHA512

2e5981e6a38b2b2b4f036f3056c818834160018d97a9393f7d461890fe51f0030ac2c3322c2421abc707e20ee01392bbf3058d9bba77e95ab7facfbed55cdda0
SSDEEP

49152:bWgm+tevgmkSG2srQHYNGFF0v9AUKoXjuqqn0F2TmoGwHP2px3V:bWgmsevgm+QQFvDXFqXRDOrV

Score

10^/10

vidar zgrat rat stealer

Malware Config

Signatures

Detect Vidar Stealer 8 IoCs

stealer

resource	yara_rule
behavioral1/memory/2704-25-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6
behavioral1/memory/2704-27-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6
behavioral1/memory/2704-29-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6
behavioral1/memory/2704-33-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6
behavioral1/memory/2704-36-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6
behavioral1/memory/2704-38-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6
behavioral1/memory/2704-39-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6
behavioral1/memory/2704-165-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2336-0-0x00000000003D0000-0x00000000008CE000-memory.dmp	family_zgrat_v1

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Loads dropped DLL 1 IoCs

pid	Process
2336	90761d7a9ac41a9602b7094663921f42.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2336 set thread context of 2704	2336	90761d7a9ac41a9602b7094663921f42.exe	27

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2440	2704	WerFault.exe	27

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	RegAsm.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2704	2336	90761d7a9ac41a9602b7094663921f42.exe	27
PID 2336 wrote to memory of 2704	2336	90761d7a9ac41a9602b7094663921f42.exe	27
PID 2336 wrote to memory of 2704	2336	90761d7a9ac41a9602b7094663921f42.exe	27
PID 2336 wrote to memory of 2704	2336	90761d7a9ac41a9602b7094663921f42.exe	27
PID 2336 wrote to memory of 2704	2336	90761d7a9ac41a9602b7094663921f42.exe	27
PID 2336 wrote to memory of 2704	2336	90761d7a9ac41a9602b7094663921f42.exe	27
PID 2336 wrote to memory of 2704	2336	90761d7a9ac41a9602b7094663921f42.exe	27
PID 2336 wrote to memory of 2704	2336	90761d7a9ac41a9602b7094663921f42.exe	27
PID 2336 wrote to memory of 2704	2336	90761d7a9ac41a9602b7094663921f42.exe	27
PID 2336 wrote to memory of 2704	2336	90761d7a9ac41a9602b7094663921f42.exe	27
PID 2336 wrote to memory of 2704	2336	90761d7a9ac41a9602b7094663921f42.exe	27
PID 2336 wrote to memory of 2704	2336	90761d7a9ac41a9602b7094663921f42.exe	27
PID 2336 wrote to memory of 2704	2336	90761d7a9ac41a9602b7094663921f42.exe	27
PID 2336 wrote to memory of 2704	2336	90761d7a9ac41a9602b7094663921f42.exe	27
PID 2704 wrote to memory of 2440	2704	RegAsm.exe	33
PID 2704 wrote to memory of 2440	2704	RegAsm.exe	33
PID 2704 wrote to memory of 2440	2704	RegAsm.exe	33
PID 2704 wrote to memory of 2440	2704	RegAsm.exe	33

C:\Users\Admin\AppData\Local\Temp\90761d7a9ac41a9602b7094663921f42.exe
"C:\Users\Admin\AppData\Local\Temp\90761d7a9ac41a9602b7094663921f42.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 1464
    3⤵
    - Program crash
    PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabE8CB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE90D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/2336-17-0x0000000000A90000-0x0000000000AD0000-memory.dmp

Filesize
256KB

Download
memory/2336-13-0x0000000000A90000-0x0000000000AD0000-memory.dmp

Filesize
256KB

Download
memory/2336-5-0x0000000006AB0000-0x0000000006C42000-memory.dmp

Filesize
1.6MB

Download
memory/2336-3-0x0000000000A90000-0x0000000000AD0000-memory.dmp

Filesize
256KB

Download
memory/2336-10-0x0000000000A90000-0x0000000000AD0000-memory.dmp

Filesize
256KB

Download
memory/2336-11-0x0000000000A90000-0x0000000000AD0000-memory.dmp

Filesize
256KB

Download
memory/2336-12-0x0000000000980000-0x0000000000990000-memory.dmp

Filesize
64KB

Download
memory/2336-35-0x00000000743D0000-0x0000000074ABE000-memory.dmp

Filesize
6.9MB

Download
memory/2336-14-0x0000000000A90000-0x0000000000AD0000-memory.dmp

Filesize
256KB

Download
memory/2336-15-0x0000000000A90000-0x0000000000AD0000-memory.dmp

Filesize
256KB

Download
memory/2336-16-0x0000000006F20000-0x0000000007020000-memory.dmp

Filesize
1024KB

Download
memory/2336-1-0x00000000743D0000-0x0000000074ABE000-memory.dmp

Filesize
6.9MB

Download
memory/2336-18-0x0000000000A90000-0x0000000000AD0000-memory.dmp

Filesize
256KB

Download
memory/2336-4-0x0000000005470000-0x0000000005696000-memory.dmp

Filesize
2.1MB

Download
memory/2336-0-0x00000000003D0000-0x00000000008CE000-memory.dmp

Filesize
5.0MB

Download
memory/2336-2-0x00000000743D0000-0x0000000074ABE000-memory.dmp

Filesize
6.9MB

Download
memory/2704-19-0x0000000000400000-0x000000000065E000-memory.dmp

Filesize
2.4MB

Download
memory/2704-27-0x0000000000400000-0x000000000065E000-memory.dmp

Filesize
2.4MB

Download
memory/2704-29-0x0000000000400000-0x000000000065E000-memory.dmp

Filesize
2.4MB

Download
memory/2704-33-0x0000000000400000-0x000000000065E000-memory.dmp

Filesize
2.4MB

Download
memory/2704-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2704-36-0x0000000000400000-0x000000000065E000-memory.dmp

Filesize
2.4MB

Download
memory/2704-25-0x0000000000400000-0x000000000065E000-memory.dmp

Filesize
2.4MB

Download
memory/2704-38-0x0000000000400000-0x000000000065E000-memory.dmp

Filesize
2.4MB

Download
memory/2704-39-0x0000000000400000-0x000000000065E000-memory.dmp

Filesize
2.4MB

Download
memory/2704-23-0x0000000000400000-0x000000000065E000-memory.dmp

Filesize
2.4MB

Download
memory/2704-21-0x0000000000400000-0x000000000065E000-memory.dmp

Filesize
2.4MB

Download
memory/2704-165-0x0000000000400000-0x000000000065E000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing