Analysis

  • max time kernel
    28s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    20-07-2021 12:49

General

  • Target

    sonia_5.exe

  • Size

    1014KB

  • MD5

    0c3f670f496ffcf516fe77d2a161a6ee

  • SHA1

    0c59d3494b38d768fe120e0a4ca2a1dca7567e6e

  • SHA256

    8ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0

  • SHA512

    bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095

Malware Config

Extracted

Family

redline

Botnet

2007

C2

37.1.219.52:6534

Extracted

Family

fickerstealer

C2

37.0.8.225:80

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

Botnet

sel17

C2

dwarimlari.xyz:80

Extracted

Family

vidar

Version

39.7

Botnet

865

C2

https://shpak125.tumblr.com/

Attributes
  • profile_id

    865

Signatures

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 6 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • redlinestealer 6 IoCs

    RedlineStealer.

  • Vidar Stealer 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 10 IoCs
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sonia_5.exe
    "C:\Users\Admin\AppData\Local\Temp\sonia_5.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Users\Admin\Documents\uv3zRWlbOBErYMXHCCY5PDxf.exe
      "C:\Users\Admin\Documents\uv3zRWlbOBErYMXHCCY5PDxf.exe"
      2⤵
      • Executes dropped EXE
      PID:1752
      • C:\Users\Admin\Documents\uv3zRWlbOBErYMXHCCY5PDxf.exe
        C:\Users\Admin\Documents\uv3zRWlbOBErYMXHCCY5PDxf.exe
        3⤵
          PID:2944
      • C:\Users\Admin\Documents\2NvlmwDVOSaHCd9btJVkTLop.exe
        "C:\Users\Admin\Documents\2NvlmwDVOSaHCd9btJVkTLop.exe"
        2⤵
          PID:292
        • C:\Users\Admin\Documents\27sm5dtve0IrJd5YdDiYbFjZ.exe
          "C:\Users\Admin\Documents\27sm5dtve0IrJd5YdDiYbFjZ.exe"
          2⤵
          • Executes dropped EXE
          PID:1668
        • C:\Users\Admin\Documents\W5auagijfjO_osak67imq75H.exe
          "C:\Users\Admin\Documents\W5auagijfjO_osak67imq75H.exe"
          2⤵
            PID:1596
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp
              3⤵
                PID:2908
                • C:\Windows\SysWOW64\cmd.exe
                  cmd
                  4⤵
                    PID:2984
                    • C:\Windows\SysWOW64\findstr.exe
                      findstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp
                      5⤵
                        PID:2996
                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
                        Acre.exe.com k
                        5⤵
                          PID:2088
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 127.0.0.1 -n 30
                          5⤵
                          • Runs ping.exe
                          PID:676
                  • C:\Users\Admin\Documents\JcXYhkwQShbDGc8ijlFY0WnI.exe
                    "C:\Users\Admin\Documents\JcXYhkwQShbDGc8ijlFY0WnI.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:764
                  • C:\Users\Admin\Documents\faxrjd4El9M8ISscDaJMq0_C.exe
                    "C:\Users\Admin\Documents\faxrjd4El9M8ISscDaJMq0_C.exe"
                    2⤵
                      PID:1100
                    • C:\Users\Admin\Documents\rPizQkrcfvpyGPNxZkGNSwR0.exe
                      "C:\Users\Admin\Documents\rPizQkrcfvpyGPNxZkGNSwR0.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:1244
                    • C:\Users\Admin\Documents\tRecm8SdTaFX42EMrOaXJoxo.exe
                      "C:\Users\Admin\Documents\tRecm8SdTaFX42EMrOaXJoxo.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:1560
                    • C:\Users\Admin\Documents\gWoabDP1RCIYrtY5YPLBPAuK.exe
                      "C:\Users\Admin\Documents\gWoabDP1RCIYrtY5YPLBPAuK.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:1064
                    • C:\Users\Admin\Documents\06dWaP1K2FnQUy6bfOZ7wPSP.exe
                      "C:\Users\Admin\Documents\06dWaP1K2FnQUy6bfOZ7wPSP.exe"
                      2⤵
                        PID:1648
                      • C:\Users\Admin\Documents\CwLh6oe44WZB5d60bk4couOW.exe
                        "C:\Users\Admin\Documents\CwLh6oe44WZB5d60bk4couOW.exe"
                        2⤵
                          PID:2044
                        • C:\Users\Admin\Documents\l5HfL8Oi3HpjquV86CSHDlZn.exe
                          "C:\Users\Admin\Documents\l5HfL8Oi3HpjquV86CSHDlZn.exe"
                          2⤵
                            PID:1952
                          • C:\Users\Admin\Documents\3hW4JL0EIAVzBuOd8jhnmKF0.exe
                            "C:\Users\Admin\Documents\3hW4JL0EIAVzBuOd8jhnmKF0.exe"
                            2⤵
                              PID:1312
                            • C:\Users\Admin\Documents\s2S6V8o_sEqPndl5NMSJeyz7.exe
                              "C:\Users\Admin\Documents\s2S6V8o_sEqPndl5NMSJeyz7.exe"
                              2⤵
                                PID:1976
                              • C:\Users\Admin\Documents\6Jb1qOpnNayT8ja9jeyPUBXi.exe
                                "C:\Users\Admin\Documents\6Jb1qOpnNayT8ja9jeyPUBXi.exe"
                                2⤵
                                  PID:1604
                                • C:\Users\Admin\Documents\mo_wRuwu5b1jvMStngdQnMa1.exe
                                  "C:\Users\Admin\Documents\mo_wRuwu5b1jvMStngdQnMa1.exe"
                                  2⤵
                                    PID:2144
                                    • C:\Users\Admin\Documents\mo_wRuwu5b1jvMStngdQnMa1.exe
                                      "C:\Users\Admin\Documents\mo_wRuwu5b1jvMStngdQnMa1.exe"
                                      3⤵
                                        PID:2416
                                    • C:\Users\Admin\Documents\Uui5OdUPlPzIDg9myAAi2SC4.exe
                                      "C:\Users\Admin\Documents\Uui5OdUPlPzIDg9myAAi2SC4.exe"
                                      2⤵
                                        PID:2228
                                      • C:\Users\Admin\Documents\w2NOdeIbvyB5OJUROrKhamB7.exe
                                        "C:\Users\Admin\Documents\w2NOdeIbvyB5OJUROrKhamB7.exe"
                                        2⤵
                                          PID:2208

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • memory/292-122-0x0000000000240000-0x0000000000241000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/292-98-0x00000000011E0000-0x00000000011E1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/764-87-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1100-156-0x00000000009B0000-0x00000000009B1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1244-146-0x0000000000D30000-0x0000000000D31000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1312-184-0x0000000000400000-0x00000000008EC000-memory.dmp

                                        Filesize

                                        4.9MB

                                      • memory/1312-175-0x0000000000220000-0x00000000002BD000-memory.dmp

                                        Filesize

                                        628KB

                                      • memory/1560-152-0x0000000000870000-0x0000000000871000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1560-167-0x0000000004120000-0x0000000004121000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1604-149-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1648-99-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1648-123-0x0000000000160000-0x0000000000161000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1652-60-0x00000000754F1000-0x00000000754F3000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1752-154-0x0000000001360000-0x0000000001361000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1752-168-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1952-155-0x00000000008E0000-0x00000000008E1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1976-158-0x0000000000400000-0x00000000008A2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1976-142-0x0000000000220000-0x000000000024F000-memory.dmp

                                        Filesize

                                        188KB

                                      • memory/2144-144-0x0000000000220000-0x0000000000267000-memory.dmp

                                        Filesize

                                        284KB

                                      • memory/2208-165-0x0000000000400000-0x0000000000D41000-memory.dmp

                                        Filesize

                                        9.3MB

                                      • memory/2208-164-0x0000000001390000-0x0000000001CB6000-memory.dmp

                                        Filesize

                                        9.1MB

                                      • memory/2416-147-0x0000000000400000-0x000000000044E000-memory.dmp

                                        Filesize

                                        312KB

                                      • memory/2416-153-0x0000000000400000-0x000000000044E000-memory.dmp

                                        Filesize

                                        312KB

                                      • memory/2944-180-0x0000000000400000-0x000000000041E000-memory.dmp

                                        Filesize

                                        120KB

                                      • memory/2944-183-0x0000000000400000-0x000000000041E000-memory.dmp

                                        Filesize

                                        120KB