General

  • Target

    41CCF2991FAF22D76A6D0F1BC576676C.exe

  • Size

    530KB

  • Sample

    210611-3xnnab4rwn

  • MD5

    41ccf2991faf22d76a6d0f1bc576676c

  • SHA1

    33a81d32c114e65434f2213ef78d78674d23c1dd

  • SHA256

    20593dd40ac0559ee48756078596dc482d5c1ee417518988777e34c174c01d3c

  • SHA512

    f955b48e761116ed2b18ed899bbe201f8327c08ad0f911852be0688d16b37798eba3202a1e89cec5ad0015fdbee9c8a3f387fe1ac6a37d136ed5b2b21f992699

Malware Config

Extracted

Family

danabot

Version

1827

Botnet

3

C2

192.210.198.12:443

37.220.31.50:443

184.95.51.183:443

184.95.51.175:443

Attributes
  • embedded_hash

    410EB249B3A3D8613B29638D583F7193

rsa_pubkey.plain
rsa_pubkey.plain

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

vidar

Version

39.3

Botnet

915

C2

https://bandakere.tumblr.com

Attributes
  • profile_id

    915

Extracted

Family

redline

Botnet

609

C2

116.202.18.132:38563

Targets

    • Target

      41CCF2991FAF22D76A6D0F1BC576676C.exe

    • Size

      530KB

    • MD5

      41ccf2991faf22d76a6d0f1bc576676c

    • SHA1

      33a81d32c114e65434f2213ef78d78674d23c1dd

    • SHA256

      20593dd40ac0559ee48756078596dc482d5c1ee417518988777e34c174c01d3c

    • SHA512

      f955b48e761116ed2b18ed899bbe201f8327c08ad0f911852be0688d16b37798eba3202a1e89cec5ad0015fdbee9c8a3f387fe1ac6a37d136ed5b2b21f992699

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    • Vidar Stealer

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

4
T1112

Disabling Security Tools

1
T1089

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

3
T1081

Discovery

Software Discovery

1
T1518

Query Registry

6
T1012

System Information Discovery

6
T1082

Peripheral Device Discovery

2
T1120

Remote System Discovery

1
T1018

Collection

Data from Local System

3
T1005

Command and Control

Web Service

1
T1102

Tasks