General
-
Target
5317048698830848.zip
-
Size
6.0MB
-
Sample
211216-xeq5xscga3
-
MD5
3fcd3282025425bc4399e1e31bfee2da
-
SHA1
a076249925b6469a5a175b98ac74535fc1c164f0
-
SHA256
669ae7546f43d4f4c06680ccf97908e524ad1ccd818d13e2cc8460619ce753a3
-
SHA512
0610df228fe965062df687b196f09b46d1e2d6ad7fa83d362252391cc34c644ac1dcb6796f36b9497f5d6c22afda891d4a98eba69ac8b28155ad724f68e2f31c
Static task
static1
Behavioral task
behavioral1
Sample
7e937f29320a38d6ed0e384bc19cc45dd3b06c32edb635a905663d063d226277.exe
Resource
win7-en-20211208
Malware Config
Extracted
socelars
http://www.yarchworkshop.com/
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
Extracted
vidar
49.1
915
https://noc.social/@sergeev46
https://c.im/@sergeev47
-
profile_id
915
Extracted
redline
v2user1
159.69.246.184:13127
Extracted
redline
media14n
65.108.69.168:13293
Targets
-
-
Target
7e937f29320a38d6ed0e384bc19cc45dd3b06c32edb635a905663d063d226277
-
Size
6.0MB
-
MD5
86ccfd1a65f0462d8e9f0f6f8afdfb56
-
SHA1
81d24059fc2153dcee703c5a15ddbf05bdf40dc0
-
SHA256
7e937f29320a38d6ed0e384bc19cc45dd3b06c32edb635a905663d063d226277
-
SHA512
a57371adebbe59510b6068f8b204ab296d34f8f0bdc97926ed2c239ff5d4d4521cc2b7fbd39cd26045a219754a087dca9e0f07189fafbeb77f93c3da2d467372
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Socelars Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Vidar Stealer
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Modify Registry
4Disabling Security Tools
1Install Root Certificate
1