vidar | c4e584cf945824aa5c88fa352b2a598695ae61ac591a1a4e7580503b4b8a3402

General

Target

bd1a94b7afc34843b33c32ed3c3613f0.exe
Size

796KB
MD5

bd1a94b7afc34843b33c32ed3c3613f0
SHA1

06d293b2f9921fbe8e6861387622f6034fb4da8c
SHA256

c4e584cf945824aa5c88fa352b2a598695ae61ac591a1a4e7580503b4b8a3402
SHA512

28533f33cca14da40298c4f0377509b0cc93b2b999b71f705ba8ef50eabd588c0895f812ea175c18ccf4f90b18b4f97bf9856d84aec971981709030b144aef88
SSDEEP

24576:2scQPFc8HTWK0g+W2r7fiYBlh73yTLeV38HuHf2D:2xQSUDV+W2TR7CeVM5

Score

10^/10

vidar 921 discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

39.9

Botnet

921

C2

https://prophefliloc.tumblr.com/

Attributes

profile_id
921

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2496-4-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral1/memory/2496-6-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral1/memory/2496-8-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral1/memory/2496-91-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

bd1a94b7afc34843b33c32ed3c3613f0.exe

description pid process target process

PID 2860 set thread context of 2496 2860 bd1a94b7afc34843b33c32ed3c3613f0.exe bd1a94b7afc34843b33c32ed3c3613f0.exe

description	pid	process	target process
PID 2860 set thread context of 2496	2860	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bd1a94b7afc34843b33c32ed3c3613f0.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bd1a94b7afc34843b33c32ed3c3613f0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bd1a94b7afc34843b33c32ed3c3613f0.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

bd1a94b7afc34843b33c32ed3c3613f0.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	bd1a94b7afc34843b33c32ed3c3613f0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	bd1a94b7afc34843b33c32ed3c3613f0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	bd1a94b7afc34843b33c32ed3c3613f0.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

bd1a94b7afc34843b33c32ed3c3613f0.exe

pid	process
2496	bd1a94b7afc34843b33c32ed3c3613f0.exe
2496	bd1a94b7afc34843b33c32ed3c3613f0.exe
2496	bd1a94b7afc34843b33c32ed3c3613f0.exe
2496	bd1a94b7afc34843b33c32ed3c3613f0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bd1a94b7afc34843b33c32ed3c3613f0.exe

description pid process

Token: SeDebugPrivilege 2860 bd1a94b7afc34843b33c32ed3c3613f0.exe

description	pid	process
Token: SeDebugPrivilege	2860	bd1a94b7afc34843b33c32ed3c3613f0.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

bd1a94b7afc34843b33c32ed3c3613f0.exe

description	pid	process	target process
PID 2860 wrote to memory of 2496	2860	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe
PID 2860 wrote to memory of 2496	2860	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe
PID 2860 wrote to memory of 2496	2860	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe
PID 2860 wrote to memory of 2496	2860	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe
PID 2860 wrote to memory of 2496	2860	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe
PID 2860 wrote to memory of 2496	2860	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe
PID 2860 wrote to memory of 2496	2860	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe
PID 2860 wrote to memory of 2496	2860	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe
PID 2860 wrote to memory of 2496	2860	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe

C:\Users\Admin\AppData\Local\Temp\bd1a94b7afc34843b33c32ed3c3613f0.exe
"C:\Users\Admin\AppData\Local\Temp\bd1a94b7afc34843b33c32ed3c3613f0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860

C:\Users\Admin\AppData\Local\Temp\bd1a94b7afc34843b33c32ed3c3613f0.exe
C:\Users\Admin\AppData\Local\Temp\bd1a94b7afc34843b33c32ed3c3613f0.exe
2⤵
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2496

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1

T1553

Install Root Certificate

Modify Registry

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\softokn3.dll
Filesize
275B

MD5
a378c450e6ad9f1e0356ed46da190990

SHA1
d457a2c162391d2ea30ec2dc62c8fb3b973f6a66

SHA256
b745b0c0db87a89de5e542e9ae0a06f585793ac3f4240bff3524e7dbdba79978

SHA512
e6cdc8f570af97e48b1d8968730db0afc46f9dd6ad7366a936a5518801debb61c86cc61526e5e26e7ad3b3daeb76a19b32d7c0da33140597f6d19163683c12b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar767E.tmp
Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
memory/2496-4-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2496-6-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2496-8-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2496-91-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2860-0-0x0000000000C60000-0x0000000000D2A000-memory.dmp

Filesize
808KB

Download
memory/2860-1-0x0000000074050000-0x000000007473E000-memory.dmp

Filesize
6.9MB

Download
memory/2860-2-0x0000000005140000-0x0000000005180000-memory.dmp

Filesize
256KB

Download
memory/2860-3-0x0000000000260000-0x0000000000286000-memory.dmp

Filesize
152KB

Download
memory/2860-7-0x0000000074050000-0x000000007473E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads