Overview

overview

10

Static

static

setup_x86_...ll.exe

windows7_x64

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows7_x64

setup_x86_...ll.exe

windows11_x64

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

Resubmissions

01-11-2021 20:09

211101-yw5kbaafg5 10

01-11-2021 07:13

211101-h2lrdsdhhj 10

01-11-2021 06:40

211101-hfpk6adhfj 10

31-10-2021 18:27

211031-w3r7fsdafj 10

31-10-2021 14:10

211031-rgstmscghm 10

31-10-2021 08:02

211031-jxchlacefm 10

31-10-2021 06:36

211031-hczxqacddp 10

31-10-2021 06:23

211031-g5wv4affb3 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    setup_x86_x64_install.exe

  • Size

    4.5MB

  • Sample

    211101-h2lrdsdhhj

  • MD5

    3da25ccfa9c258e3ae26854391531c7b

  • SHA1

    1ed5613b0ad8ab4c47f07e52199a4edd27be40e6

  • SHA256

    62be0ca52ea9ebc4c577d597b919f6b90cebdcc2179d7d482a04bf5731eec720

  • SHA512

    defed576df3d8325259884b485a0dc7cd673c47028e77f189255e27dca312a0befdc8dc84106cc3103a3027e67a835fad899f9361076a64831db144354a4618c

Score
10/10
amadeyformbookicedidredlinesmokeloadersocelarsvidar869933srtupdate333022016856aspackv2backdoorbankerdiscoveryevasionexploitinfostealerpersistencespywarestealersuricatathemidatrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://brandyjaggers.com/upload/

http://andbal.com/upload/

http://alotofquotes.com/upload/

http://szpnc.cn/upload/

http://uggeboots.com/upload/

http://100klv.com/upload/

http://rapmusic.at/upload/
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

srtupdate33

C2

135.181.129.119:4805

Extracted

Family

vidar

Version

47.8

Botnet

869

C2

https://mas.to/@romashkin

Attributes
  • profile_id

    869

Extracted

Family

vidar

Version

41.6

Botnet

933

C2

https://mas.to/@lilocc

Attributes
  • profile_id

    933

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Extracted

Family

icedid

Campaign

3022016856

Targets

    • Target

      setup_x86_x64_install.exe

    • Size

      4.5MB

    • MD5

      3da25ccfa9c258e3ae26854391531c7b

    • SHA1

      1ed5613b0ad8ab4c47f07e52199a4edd27be40e6

    • SHA256

      62be0ca52ea9ebc4c577d597b919f6b90cebdcc2179d7d482a04bf5731eec720

    • SHA512

      defed576df3d8325259884b485a0dc7cd673c47028e77f189255e27dca312a0befdc8dc84106cc3103a3027e67a835fad899f9361076a64831db144354a4618c

    Score
    10/10
    redlinesmokeloadersocelarsvidar869933srtupdate33aspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojanexploitamadeyformbookicedid3022016856bankerthemida

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies system executable filetype association

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Registers COM server for autorun

      persistence

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

      stealersocelars

    • Socelars Payload

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • suricata: ET MALWARE Amadey CnC Check-In

      suricata: ET MALWARE Amadey CnC Check-In

      suricata

    • suricata: ET MALWARE ClipBanker Variant Activity (POST)

      suricata: ET MALWARE ClipBanker Variant Activity (POST)

      suricata

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata

    • suricata: ET MALWARE GCleaner Downloader Activity M5

      suricata: ET MALWARE GCleaner Downloader Activity M5

      suricata

    • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

      suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

      suricata

    • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

      suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

      suricata

    • suricata: ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad

      suricata: ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad

      suricata

    • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

      suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

      suricata

    • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

      suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

      suricata

    • suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

      suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

      suricata

    • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

      suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

      suricata

    • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

      suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

      suricata

    • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

      suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

      suricata

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata

    • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

      suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

      suricata

    • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

      suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

      suricata

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Vidar Stealer

      stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Possible privilege escalation attempt

      exploit

    • Sets service image path in registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Change Default File Association

1
T1042

Registry Run Keys / Startup Folder

4
T1060

Account Manipulation

1
T1098

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

8
T1112

Disabling Security Tools

1
T1089

Virtualization/Sandbox Evasion

1
T1497

File Permissions Modification

1
T1222

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

8
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

8
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks

static1

Score
N/A

behavioral1

redlinesmokeloadersocelarsvidar869933srtupdate33aspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojan
Score
10/10

behavioral2

socelarsaspackv2discoveryevasionexploitpersistencespywarestealersuricatatrojan
Score
10/10

behavioral3

redlinesmokeloadersocelarsvidar869933srtupdate33aspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojan
Score
10/10

behavioral4

amadeyformbookicedidredlinesocelarsvidarsrtupdate333022016856aspackv2bankerdiscoveryevasioninfostealerpersistencespywarestealersuricatathemidatrojan
Score
10/10

behavioral5

formbookredlinesmokeloadersocelarsvidar933srtupdate33aspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojan
Score
10/10

behavioral6

formbookredlinesmokeloadersocelarsvidar933srtupdate33aspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatathemidatrojan
Score
10/10

behavioral7

redlinesmokeloadersocelarsvidar933srtupdate33aspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojan
Score
10/10