vidar | c4e584cf945824aa5c88fa352b2a598695ae61ac591a1a4e7580503b4b8a3402

General

Target

bd1a94b7afc34843b33c32ed3c3613f0.exe
Size

796KB
MD5

bd1a94b7afc34843b33c32ed3c3613f0
SHA1

06d293b2f9921fbe8e6861387622f6034fb4da8c
SHA256

c4e584cf945824aa5c88fa352b2a598695ae61ac591a1a4e7580503b4b8a3402
SHA512

28533f33cca14da40298c4f0377509b0cc93b2b999b71f705ba8ef50eabd588c0895f812ea175c18ccf4f90b18b4f97bf9856d84aec971981709030b144aef88
SSDEEP

24576:2scQPFc8HTWK0g+W2r7fiYBlh73yTLeV38HuHf2D:2xQSUDV+W2TR7CeVM5

Score

10^/10

vidar 921 spyware stealer

Malware Config

Extracted

Family

vidar

Version

39.9

Botnet

921

C2

https://prophefliloc.tumblr.com/

Attributes

profile_id
921

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/4260-7-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4260-9-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4260-11-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4260-12-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4260-66-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

bd1a94b7afc34843b33c32ed3c3613f0.exe

description pid process target process

PID 1392 set thread context of 4260 1392 bd1a94b7afc34843b33c32ed3c3613f0.exe bd1a94b7afc34843b33c32ed3c3613f0.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5088 4260 WerFault.exe bd1a94b7afc34843b33c32ed3c3613f0.exe

description	pid	process	target process
PID 1392 set thread context of 4260	1392	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe

pid	pid_target	process	target process
5088	4260	WerFault.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

bd1a94b7afc34843b33c32ed3c3613f0.exe

pid	process
4260	bd1a94b7afc34843b33c32ed3c3613f0.exe
4260	bd1a94b7afc34843b33c32ed3c3613f0.exe
4260	bd1a94b7afc34843b33c32ed3c3613f0.exe
4260	bd1a94b7afc34843b33c32ed3c3613f0.exe
4260	bd1a94b7afc34843b33c32ed3c3613f0.exe
4260	bd1a94b7afc34843b33c32ed3c3613f0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bd1a94b7afc34843b33c32ed3c3613f0.exe

description pid process

Token: SeDebugPrivilege 1392 bd1a94b7afc34843b33c32ed3c3613f0.exe

description	pid	process
Token: SeDebugPrivilege	1392	bd1a94b7afc34843b33c32ed3c3613f0.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

bd1a94b7afc34843b33c32ed3c3613f0.exe

description	pid	process	target process
PID 1392 wrote to memory of 4260	1392	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe
PID 1392 wrote to memory of 4260	1392	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe
PID 1392 wrote to memory of 4260	1392	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe
PID 1392 wrote to memory of 4260	1392	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe
PID 1392 wrote to memory of 4260	1392	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe
PID 1392 wrote to memory of 4260	1392	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe
PID 1392 wrote to memory of 4260	1392	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe
PID 1392 wrote to memory of 4260	1392	bd1a94b7afc34843b33c32ed3c3613f0.exe	bd1a94b7afc34843b33c32ed3c3613f0.exe

C:\Users\Admin\AppData\Local\Temp\bd1a94b7afc34843b33c32ed3c3613f0.exe
"C:\Users\Admin\AppData\Local\Temp\bd1a94b7afc34843b33c32ed3c3613f0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392

C:\Users\Admin\AppData\Local\Temp\bd1a94b7afc34843b33c32ed3c3613f0.exe
C:\Users\Admin\AppData\Local\Temp\bd1a94b7afc34843b33c32ed3c3613f0.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 1736
3⤵
- Program crash
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4260 -ip 4260
1⤵
PID:2792

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\softokn3.dll
Filesize
275B

MD5
a378c450e6ad9f1e0356ed46da190990

SHA1
d457a2c162391d2ea30ec2dc62c8fb3b973f6a66

SHA256
b745b0c0db87a89de5e542e9ae0a06f585793ac3f4240bff3524e7dbdba79978

SHA512
e6cdc8f570af97e48b1d8968730db0afc46f9dd6ad7366a936a5518801debb61c86cc61526e5e26e7ad3b3daeb76a19b32d7c0da33140597f6d19163683c12b5

Download Submit
memory/1392-6-0x0000000005070000-0x0000000005096000-memory.dmp

Filesize
152KB

Download
memory/1392-2-0x0000000005430000-0x00000000059D4000-memory.dmp

Filesize
5.6MB

Download
memory/1392-3-0x0000000004E80000-0x0000000004F12000-memory.dmp

Filesize
584KB

Download
memory/1392-4-0x00000000050C0000-0x00000000050D0000-memory.dmp

Filesize
64KB

Download
memory/1392-5-0x0000000004E10000-0x0000000004E1A000-memory.dmp

Filesize
40KB

Download
memory/1392-0-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/1392-10-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/1392-1-0x0000000000360000-0x000000000042A000-memory.dmp

Filesize
808KB

Download
memory/4260-7-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4260-9-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4260-11-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4260-12-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4260-66-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads