Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    daa924a51f13b11f37dac4ed05098052357d6c78816e121c9105c118692bd1a2

  • Size

    247KB

  • Sample

    210907-a7m8eaeghm

  • MD5

    207bb33577d0f8f3831a45858138d96b

  • SHA1

    7a4f99fa0a75a6ddcab1901de445b3b2f4ea3267

  • SHA256

    daa924a51f13b11f37dac4ed05098052357d6c78816e121c9105c118692bd1a2

  • SHA512

    09b757069da156ffcb046ffb88562ef216b14a00ad125c8f8bdf4024a35158fe98dadff9b549e7ed933796a70594a4f4f3d65eedbd9506ae658c2fdb81f035ed

Score
10/10
asyncratnjratquasarraccoonredlinesmokeloaderxmrigc0a9feb2a4e39ae5dc9126aeda03d4a8d900a1bfoffice04backdoorevasioninfostealerminerpersistenceratspywarestealerthemidatrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://fazanaharahe1.xyz/

http://xandelissane2.xyz/

http://ustiassosale3.xyz/

http://cytheriata4.xyz/

http://ggiergionard5.xyz/

http://rrelleynaniy6.store/

http://danniemusoa7.store/

http://nastanizab8.store/

http://onyokandis9.store/

http://dmunaavank10.store/

http://gilmandros11.site/

http://cusanthana12.site/

http://willietjeana13.site/

http://ximusokall14.site/

http://blodinetisha15.site/

http://urydiahadyss16.club/

http://glasamaddama17.club/

http://marlingarly18.club/

http://alluvianna19.club/

http://xandirkaniel20.club/
rc4.i32
rc4.i32

Extracted

Family

redline

C2

45.14.49.232:14970

Extracted

Family

njrat

C2

62.33.159.162:5674

Mutex

26c50014115b430

Attributes
  • reg_key

    26c50014115b430

  • splitter

    @!#&^%$

Extracted

Family

raccoon

Botnet

c0a9feb2a4e39ae5dc9126aeda03d4a8d900a1bf

Attributes
  • url4cnc

    https://telete.in/hotcarzooncon

rc4.plain
rc4.plain

Extracted

Family

asyncrat

Version

0.5.7B

C2

null:null

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • aes_key

    8FA9JRFjWXueotm7qWCj4Zax4AHfQdgS

  • anti_detection

    true

  • autorun

    true

  • bdos

    false

  • delay

    Default

  • host

    null

  • hwid

    3

  • install_file

  • install_folder

    %AppData%

  • mutex

    AsyncMutex_6SI8OkPnk

  • pastebin_config

    https://pastebin.com/raw/JBB6AAZb

  • port

    null

  • version

    0.5.7B

aes.plain

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

C2

8.tcp.ngrok.io:12199

Mutex

77e1716f-a8ee-4809-837a-f0b960ec437d

Attributes
  • encryption_key

    66E7B222E349FE5DA72098D60610AEAB3132B98F

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      daa924a51f13b11f37dac4ed05098052357d6c78816e121c9105c118692bd1a2

    • Size

      247KB

    • MD5

      207bb33577d0f8f3831a45858138d96b

    • SHA1

      7a4f99fa0a75a6ddcab1901de445b3b2f4ea3267

    • SHA256

      daa924a51f13b11f37dac4ed05098052357d6c78816e121c9105c118692bd1a2

    • SHA512

      09b757069da156ffcb046ffb88562ef216b14a00ad125c8f8bdf4024a35158fe98dadff9b549e7ed933796a70594a4f4f3d65eedbd9506ae658c2fdb81f035ed

    Score
    10/10
    asyncratnjratquasarraccoonredlinesmokeloaderxmrigc0a9feb2a4e39ae5dc9126aeda03d4a8d900a1bfoffice04backdoorevasioninfostealerminerpersistenceratspywarestealerthemidatrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Quasar Payload

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Async RAT payload

      rat

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • XMRig Miner Payload

      miner

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Disabling Security Tools

1
T1089

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks