General
-
Target
Assassin_s_creed_keygen.zip
-
Size
4.8MB
-
Sample
210316-zqfqsgl7c6
-
MD5
0183aeb64680b690e444b9a9e02a7247
-
SHA1
08fb07bd9c1868b11634cf1db55e5a357f5dd2cb
-
SHA256
ca442088af89f7e9b8a35e8d856574782066a80b0a89d806a1f9aed2af2aa1c3
-
SHA512
630bfbf7b363f47b1a3cccfb4c008897f3c046b2e04f748af9cdfc69c51316dd0a0369fec2d0222c5c6f70f7291db6a3cdffddff1f75e6e61d6fdd7142cca9ff
Static task
static1
Behavioral task
behavioral1
Sample
Assassin_s_creed_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Assassin_s_creed_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Assassin_s_creed_keygen.exe
Resource
win10v20201028
Malware Config
Extracted
http://labsclub.com/welcome
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
fickerstealer
deniedfight.com:80
Extracted
redline
Azrok
45.144.225.163:24037
Extracted
icedid
2275185932
daweci9.uno
Extracted
metasploit
windows/single_exec
Targets
-
-
Target
Assassin_s_creed_keygen.exe
-
Size
4.9MB
-
MD5
5c4bf24586f616287d89abdcfa79d1af
-
SHA1
5d9f3e4a072c918a0ee60b99e5675243b0d97668
-
SHA256
e4e41ee8db1568630dfd4da0e18b9497c97b2dc2d7b4dbdb96715e4b93f98119
-
SHA512
46a87d141a899fdd139443a452206803c2f738157ae4d99d106755798368275724af94d8f44c82926e1ab05b6c4489efd1c036c8ee4965079b4b1a0c61ef23fa
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Glupteba Payload
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Checks for common network interception software
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
IcedID First Stage Loader
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VirtualBox Guest Additions in registry
-
Modifies boot configuration data using bcdedit
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Looks for VMWare Tools registry key
-
Modifies Windows Firewall
-
Possible attempt to disable PatchGuard
Rootkits can use kernel patching to embed themselves in an operating system.
-
Sets service image path in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
2Scheduled Task
1Defense Evasion
Disabling Security Tools
2Modify Registry
6Virtualization/Sandbox Evasion
3Impair Defenses
1Install Root Certificate
1