General

  • Target

    b323d0715f9172b707dd2bc941ca4cbd.exe

  • Size

    10.3MB

  • Sample

    211126-agl8eshebj

  • MD5

    b323d0715f9172b707dd2bc941ca4cbd

  • SHA1

    6d6ea08d5d99f2d53f95b86ff3ac97cd67a128d2

  • SHA256

    0990a2572d8b275f4adb305f3673f72ba4baafa1f85c7132a2306531517ebca8

  • SHA512

    18a2241969009e648b0d85fb2ad686501443fccc5023cf7b29ff704b461952dcc1b205d1c455db9b3f0105ae0455ada3e97a16b4b7f6b2906d798c68d20ff611

Malware Config

Extracted

Family

amadey

Version

2.82

C2

185.215.113.45/g4MbvE/index.php

Extracted

Family

socelars

C2

http://www.gianninidesign.com/

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

Botnet

udptest

C2

193.56.146.64:65441

Extracted

Family

redline

Botnet

Faker

C2

51.79.188.112:7110

Targets

    • Target

      b323d0715f9172b707dd2bc941ca4cbd.exe

    • Size

      10.3MB

    • MD5

      b323d0715f9172b707dd2bc941ca4cbd

    • SHA1

      6d6ea08d5d99f2d53f95b86ff3ac97cd67a128d2

    • SHA256

      0990a2572d8b275f4adb305f3673f72ba4baafa1f85c7132a2306531517ebca8

    • SHA512

      18a2241969009e648b0d85fb2ad686501443fccc5023cf7b29ff704b461952dcc1b205d1c455db9b3f0105ae0455ada3e97a16b4b7f6b2906d798c68d20ff611

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars Payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • UAC bypass

    • Windows security bypass

    • suricata: ET MALWARE Amadey CnC Check-In

      suricata: ET MALWARE Amadey CnC Check-In

    • suricata: ET MALWARE ClipBanker Variant Activity (POST)

      suricata: ET MALWARE ClipBanker Variant Activity (POST)

    • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

      suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    • Downloads MZ/PE file

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks