General
-
Target
Free.Dvd.M.Free.dvd.maker.1.1.serial.key.gen.zip
-
Size
5.2MB
-
Sample
210407-lfl9wxpgke
-
MD5
54897aff225e4f80bb1949460828ba46
-
SHA1
3dcfb334b31cd6cb51b6093e90eb5b30794db412
-
SHA256
52fb0c474021ab03884604deb0e6fbd12e4ba26d0fc561e6ac8d4012036ed532
-
SHA512
bccfab830f441c4b24da22aaf429d766564fc3e3f33be256f8a44caa9952f88615c866b5fd949d98d5ef14a055ad9ab470c0a365544dcc96023fe780d5a029e8
Static task
static1
Behavioral task
behavioral1
Sample
Free.Dvd.M.Free.dvd.maker.1.1.serial.key.gen.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Free.Dvd.M.Free.dvd.maker.1.1.serial.key.gen.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Free.Dvd.M.Free.dvd.maker.1.1.serial.key.gen.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Free.Dvd.M.Free.dvd.maker.1.1.serial.key.gen.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
Free.Dvd.M.Free.dvd.maker.1.1.serial.key.gen.exe
Resource
win7v20201028
Malware Config
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
metasploit
windows/single_exec
Extracted
http://labsclub.com/welcome
Extracted
redline
fullynew
rlmushahel.xyz:80
Extracted
redline
Kolokol
pokacienon.xyz:80
Extracted
redline
Game
silvercat.top:80
Extracted
icedid
2790753871
zagrotypressure.fun
Extracted
redline
6allsupp
jbeaef.ml:80
Extracted
redline
lilal123
olenaddia.xyz:80
Extracted
zloader
googleaktualizacija
googleaktualizacija2
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Targets
-
-
Target
Free.Dvd.M.Free.dvd.maker.1.1.serial.key.gen.exe
-
Size
5.3MB
-
MD5
6ee804d0dfabb215547b0c9f7b74d5b4
-
SHA1
b1426b6ebbc4427e6dda3148fb8e2363aa3c0689
-
SHA256
90c5b5ed7f4bdec10962af2fcd3b940eb63a81ddf8663e421ea1053f940413ba
-
SHA512
aedc55b2071176a757835436d8566f380dad4330fc93477d4dd5c3dd3f616c144a1efe9b8f73a51b645c2c91d3beb3eb5c4d6cb146e549b2d45541621d69fc69
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Glupteba Payload
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Turns off Windows Defender SpyNet reporting
-
Checks for common network interception software
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
IcedID First Stage Loader
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Modifies file permissions
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Hidden Files and Directories
1Defense Evasion
Disabling Security Tools
3Modify Registry
7Impair Defenses
1File Permissions Modification
1Install Root Certificate
1Hidden Files and Directories
1