Resubmissions

02-12-2021 07:35

211202-je6zgsfge4 10

10-09-2021 20:31

210910-za2rzaaeh3 10

10-09-2021 19:40

210910-ydvmdsdffp 10

10-09-2021 12:06

210910-n9s4bsdbep 10

10-09-2021 05:37

210910-gbjcxahdh2 10

09-09-2021 22:16

210909-17av7aghb7 10

09-09-2021 22:12

210909-14mqksgha9 10

09-09-2021 22:12

210909-14l42sgha8 10

09-09-2021 22:11

210909-14e1qsgha7 10

09-09-2021 22:11

210909-138lnacacn 10

General

  • Target

    setup_x86_x64_install.exe

  • Size

    4.3MB

  • Sample

    210909-14e1qsgha7

  • MD5

    6d18c8e8ab9051f7a70b89ff7bb0ec35

  • SHA1

    265311e2afd9f59e824f4b77162cf3dfa278eb7e

  • SHA256

    8fe6c86b038ce91a991fe6eb8a9b323bb37b554ff6b4e5c18de3fe52d4aedf6d

  • SHA512

    249bf79dc90d4662b942c7eed2a7b7816b749f6d5f7bc190bba05f826fa143d0b44f58054d8649b8626884c5fcbd1cea8abd625dc701d44b7aaac84fc74e47ff

Malware Config

Extracted

Family

vidar

Version

40.5

Botnet

706

C2

https://gheorghip.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

pab123

C2

45.14.49.169:22411

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://shellloader.com/welcome

Targets

    • Target

      setup_x86_x64_install.exe

    • Size

      4.3MB

    • MD5

      6d18c8e8ab9051f7a70b89ff7bb0ec35

    • SHA1

      265311e2afd9f59e824f4b77162cf3dfa278eb7e

    • SHA256

      8fe6c86b038ce91a991fe6eb8a9b323bb37b554ff6b4e5c18de3fe52d4aedf6d

    • SHA512

      249bf79dc90d4662b942c7eed2a7b7816b749f6d5f7bc190bba05f826fa143d0b44f58054d8649b8626884c5fcbd1cea8abd625dc701d44b7aaac84fc74e47ff

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

    • ElysiumStealer

      ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars Payload

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

Score
N/A

behavioral1

djvunetsupportredlinesmokeloadersocelarsvidar706pab123aspackv2backdoordiscoveryevasioninfostealerpersistenceransomwareratspywarestealertrojan
Score
10/10

behavioral2

redlinesmokeloadersocelarspab123aspackv2backdoordiscoveryinfostealerstealertrojan
Score
10/10

behavioral3

djvuelysiumstealerredlinesmokeloadersocelarsvidar706aspackv2backdoordiscoveryevasioninfostealerpersistenceransomwarespywarestealerthemidatrojan
Score
10/10

behavioral4

redlinesocelarspab123aspackv2infostealerstealer
Score
10/10

behavioral5

netsupportsocelarsvidaraspackv2discoveryevasionpersistenceratstealerthemida
Score
10/10

behavioral6

redlinesmokeloadersocelarsvidar706pab123aspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealerthemidatrojan
Score
10/10

behavioral7

redlinesmokeloadersocelarsvidar706pab123aspackv2backdoorinfostealerstealerthemidatrojan
Score
10/10

behavioral8

redlinesmokeloadersocelarsvidar706pab123aspackv2backdoordiscoveryinfostealerstealertrojan
Score
10/10

behavioral9

redlinesmokeloadersocelarsvidar706pab123aspackv2backdoorinfostealerstealerthemidatrojan
Score
10/10

behavioral10

redlinesmokeloadersocelarsvidar706pab123aspackv2backdoorinfostealerstealertrojan
Score
10/10