General

  • Target

    Hide_IP_Easy_v4_1_6_8_and_keygen_by_ACME (1).zip

  • Size

    8.4MB

  • Sample

    210303-r2l4zce94s

  • MD5

    9784dc1627f848a0ff38b26ef3efe840

  • SHA1

    9ec636c4a5e9495f299d305680c913f979e45cc9

  • SHA256

    823f1c91ecea169f82135ace463846e1a08b83f853862d86347a21622694c7dd

  • SHA512

    198b98889694a4f8965cac8877945577c8bbd7685c841825ba2b6b7be11732f4755dc64ec04d2a204ee37e0e33159b88177a2a0da45a91dd307cf71f1cef249e

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://labsclub.com/welcome

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Targets

    • Target

      Hide_IP_Easy_v4_1_6_8_and_keygen_by_ACME.exe

    • Size

      8.6MB

    • MD5

      ccac19809d197ccc8bfe1ec50cd095fa

    • SHA1

      00abe1d95c118d680c206736d2970a411d2f1233

    • SHA256

      8462e1f7a1e7637ddd39a6a93670d8b94ea6cac9d8e14c9711c2249d8b02b164

    • SHA512

      14c8fd2affad3a436ebc3f480faab967400d9d2c7a79835b0f39a3efeff2267b109d3cb431ee5b262f3c865295cf830c9b3b8fe1bda1e42d7a2cf8541ad9d66f

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Modifies boot configuration data using bcdedit

    • Nirsoft

    • XMRig Miner Payload

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Looks for VMWare Tools registry key

    • Modifies Windows Firewall

    • Possible attempt to disable PatchGuard

      Rootkits can use kernel patching to embed themselves in an operating system.

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks for any installed AV software in registry

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Scheduled Task

1
T1053

Persistence

Account Manipulation

1
T1098

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Bootkit

1
T1067

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Impair Defenses

1
T1562

Modify Registry

4
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

2
T1081

Discovery

Software Discovery

1
T1518

Query Registry

9
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

8
T1082

Security Software Discovery

1
T1063

Peripheral Device Discovery

3
T1120

Remote System Discovery

1
T1018

Collection

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Tasks