General

  • Target

    141F2F0295414B069C74A1BE852A05F1.exe

  • Size

    2.5MB

  • Sample

    210817-e2req4sh96

  • MD5

    141f2f0295414b069c74a1be852a05f1

  • SHA1

    4f397e56fd9fcc37d8fef315e4949adb90ff8e17

  • SHA256

    186992db0748857e13271f18b519fbf2b6f016bd8d81c3ee952786de798a6dad

  • SHA512

    3660b00e58ae6400b4754873dd7049f7ed63b8dcb8d48e217d874e1d3abf47d0c229653c90a6b60571f5464a2f6a08ebd5a1746be8b7c2f0047d52cd8a6dcf47

Malware Config

Extracted

Family

cryptbot

C2

lysoip68.top

morwaf06.top

Attributes
  • payload_url

    http://damliq08.top/download.php?file=lv.exe

Extracted

Family

redline

Botnet

test1

C2

185.215.113.15:61506

Extracted

Family

vidar

Version

40

Botnet

706

C2

https://lenak513.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

SewPalpadin

C2

185.215.113.114:8887

Extracted

Family

redline

Botnet

FIRST_7.5k

C2

45.14.49.200:27625

Extracted

Family

raccoon

Botnet

171b0ea0beebb33c2d9043b095edfe8ec188b323

Attributes
  • url4cnc

    https://telete.in/fihborntoflyes

rc4.plain
rc4.plain

Extracted

Family

metasploit

Version

windows/single_exec

Targets

    • Target

      141F2F0295414B069C74A1BE852A05F1.exe

    • Size

      2.5MB

    • MD5

      141f2f0295414b069c74a1be852a05f1

    • SHA1

      4f397e56fd9fcc37d8fef315e4949adb90ff8e17

    • SHA256

      186992db0748857e13271f18b519fbf2b6f016bd8d81c3ee952786de798a6dad

    • SHA512

      3660b00e58ae6400b4754873dd7049f7ed63b8dcb8d48e217d874e1d3abf47d0c229653c90a6b60571f5464a2f6a08ebd5a1746be8b7c2f0047d52cd8a6dcf47

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Raccoon Stealer Payload

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

Modify Registry

2
T1112

Disabling Security Tools

1
T1089

Virtualization/Sandbox Evasion

1
T1497

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

6
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

6
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

3
T1005

Command and Control

Web Service

1
T1102

Tasks