vidar | 4fd5f26eddfdc90a90dc20e8109caa2c10a71ecfd86a10ca94899ada0733e453

General

Target

c12b74ac5f1b7c8b232f1b2fc830739e.exe
Size

686KB
MD5

c12b74ac5f1b7c8b232f1b2fc830739e
SHA1

101063aea494e57423d98da511d976ce0784db57
SHA256

4fd5f26eddfdc90a90dc20e8109caa2c10a71ecfd86a10ca94899ada0733e453
SHA512

6368bc1bab671007dc1bb511f681ad3c92f9f759df247718dec1b263e2dd96438fdc9fb9d3e1b59b94e42b9fc97333296987f75163688a36f3fbb11f8ae752e1
SSDEEP

12288:e2s0BhP2PFro43nQMmo4RRNc0g+W2rQeQlAi3l0XLoRPi9:ZscQPFc8HTWK0g+W2rI6kRPi9

Score

10^/10

vidar 921 spyware stealer

Malware Config

Extracted

Family

vidar

Version

39.9

Botnet

921

C2

https://prophefliloc.tumblr.com/

Attributes

profile_id
921

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/2432-7-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/2432-8-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/2432-12-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/2432-10-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/2432-66-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

c12b74ac5f1b7c8b232f1b2fc830739e.exe

description pid process target process

PID 3720 set thread context of 2432 3720 c12b74ac5f1b7c8b232f1b2fc830739e.exe c12b74ac5f1b7c8b232f1b2fc830739e.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4632 2432 WerFault.exe c12b74ac5f1b7c8b232f1b2fc830739e.exe

description	pid	process	target process
PID 3720 set thread context of 2432	3720	c12b74ac5f1b7c8b232f1b2fc830739e.exe	c12b74ac5f1b7c8b232f1b2fc830739e.exe

pid	pid_target	process	target process
4632	2432	WerFault.exe	c12b74ac5f1b7c8b232f1b2fc830739e.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

c12b74ac5f1b7c8b232f1b2fc830739e.exe

pid	process
2432	c12b74ac5f1b7c8b232f1b2fc830739e.exe
2432	c12b74ac5f1b7c8b232f1b2fc830739e.exe
2432	c12b74ac5f1b7c8b232f1b2fc830739e.exe
2432	c12b74ac5f1b7c8b232f1b2fc830739e.exe
2432	c12b74ac5f1b7c8b232f1b2fc830739e.exe
2432	c12b74ac5f1b7c8b232f1b2fc830739e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c12b74ac5f1b7c8b232f1b2fc830739e.exe

description pid process

Token: SeDebugPrivilege 3720 c12b74ac5f1b7c8b232f1b2fc830739e.exe

description	pid	process
Token: SeDebugPrivilege	3720	c12b74ac5f1b7c8b232f1b2fc830739e.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c12b74ac5f1b7c8b232f1b2fc830739e.exe

description	pid	process	target process
PID 3720 wrote to memory of 2432	3720	c12b74ac5f1b7c8b232f1b2fc830739e.exe	c12b74ac5f1b7c8b232f1b2fc830739e.exe
PID 3720 wrote to memory of 2432	3720	c12b74ac5f1b7c8b232f1b2fc830739e.exe	c12b74ac5f1b7c8b232f1b2fc830739e.exe
PID 3720 wrote to memory of 2432	3720	c12b74ac5f1b7c8b232f1b2fc830739e.exe	c12b74ac5f1b7c8b232f1b2fc830739e.exe
PID 3720 wrote to memory of 2432	3720	c12b74ac5f1b7c8b232f1b2fc830739e.exe	c12b74ac5f1b7c8b232f1b2fc830739e.exe
PID 3720 wrote to memory of 2432	3720	c12b74ac5f1b7c8b232f1b2fc830739e.exe	c12b74ac5f1b7c8b232f1b2fc830739e.exe
PID 3720 wrote to memory of 2432	3720	c12b74ac5f1b7c8b232f1b2fc830739e.exe	c12b74ac5f1b7c8b232f1b2fc830739e.exe
PID 3720 wrote to memory of 2432	3720	c12b74ac5f1b7c8b232f1b2fc830739e.exe	c12b74ac5f1b7c8b232f1b2fc830739e.exe
PID 3720 wrote to memory of 2432	3720	c12b74ac5f1b7c8b232f1b2fc830739e.exe	c12b74ac5f1b7c8b232f1b2fc830739e.exe

C:\Users\Admin\AppData\Local\Temp\c12b74ac5f1b7c8b232f1b2fc830739e.exe
"C:\Users\Admin\AppData\Local\Temp\c12b74ac5f1b7c8b232f1b2fc830739e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3720

C:\Users\Admin\AppData\Local\Temp\c12b74ac5f1b7c8b232f1b2fc830739e.exe
C:\Users\Admin\AppData\Local\Temp\c12b74ac5f1b7c8b232f1b2fc830739e.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 1560
3⤵
- Program crash
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2432 -ip 2432
1⤵
PID:3076

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\softokn3.dll
Filesize
275B

MD5
a378c450e6ad9f1e0356ed46da190990

SHA1
d457a2c162391d2ea30ec2dc62c8fb3b973f6a66

SHA256
b745b0c0db87a89de5e542e9ae0a06f585793ac3f4240bff3524e7dbdba79978

SHA512
e6cdc8f570af97e48b1d8968730db0afc46f9dd6ad7366a936a5518801debb61c86cc61526e5e26e7ad3b3daeb76a19b32d7c0da33140597f6d19163683c12b5

Download Submit
memory/2432-7-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2432-66-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2432-10-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2432-12-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2432-8-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3720-6-0x0000000005780000-0x00000000057A8000-memory.dmp

Filesize
160KB

Download
memory/3720-1-0x00000000750A0000-0x0000000075850000-memory.dmp

Filesize
7.7MB

Download
memory/3720-5-0x00000000056E0000-0x00000000056EA000-memory.dmp

Filesize
40KB

Download
memory/3720-11-0x00000000750A0000-0x0000000075850000-memory.dmp

Filesize
7.7MB

Download
memory/3720-4-0x00000000057C0000-0x00000000057D0000-memory.dmp

Filesize
64KB

Download
memory/3720-3-0x0000000005540000-0x00000000055D2000-memory.dmp

Filesize
584KB

Download
memory/3720-2-0x0000000005A50000-0x0000000005FF4000-memory.dmp

Filesize
5.6MB

Download
memory/3720-0-0x0000000000AA0000-0x0000000000B4E000-memory.dmp

Filesize
696KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads