Resubmissions

17-01-2021 18:30

210117-q3vy6kg7wx 1

26-12-2020 16:39

201226-mkwafa6hqe 10

General

  • Target

    ElectraSoft_FaxMail_Network_keygen_by_aaocg.exe

  • Size

    8MB

  • Sample

    201226-mkwafa6hqe

  • MD5

    7783fb57f7fe810c9dcfbbfda2b47eb6

  • SHA1

    2892bfd93cf7ef01e928960ecd5cc082bca99f3e

  • SHA256

    6d5307f8ae9c15be09190b6ff1f2c557d7a0519b765b6ef020ac3e7343fb190c

  • SHA512

    171a6b1651cd062869a5b979616e54a57b83e14af969d19a8aa344c2d5ed123a5d00ec8a51c2713146b9bfd2ec37c4c335cc0240cb0890b60b768e50cfc7478a

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

smokeloader

Version

2020

C2

http://naritouzina.net/

http://nukaraguasleep.net/

http://notfortuaj.net/

http://natuturalistic.net/

http://zaniolofusa.net/

rc4.i32
rc4.i32

Targets

    • Target

      ElectraSoft_FaxMail_Network_keygen_by_aaocg.exe

    • Size

      8MB

    • MD5

      7783fb57f7fe810c9dcfbbfda2b47eb6

    • SHA1

      2892bfd93cf7ef01e928960ecd5cc082bca99f3e

    • SHA256

      6d5307f8ae9c15be09190b6ff1f2c557d7a0519b765b6ef020ac3e7343fb190c

    • SHA512

      171a6b1651cd062869a5b979616e54a57b83e14af969d19a8aa344c2d5ed123a5d00ec8a51c2713146b9bfd2ec37c4c335cc0240cb0890b60b768e50cfc7478a

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Windows security bypass

    • Creates new service(s)

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Sets service image path in registry

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Modifies file permissions

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • JavaScript code in executable

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

2
T1060

Bootkit

1
T1067

Privilege Escalation

New Service

1
T1050

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

5
T1112

File Permissions Modification

1
T1222

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

5
T1081

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Collection

Data from Local System

5
T1005

Command and Control

Web Service

1
T1102

Tasks