Resubmissions

11/01/2022, 13:15

220111-qhegzagaan 1

10/01/2022, 14:58

220110-scd1csefhk 10

General

  • Target

    https://www.youtube.com/watch?v=U7MxPq1i_nI

  • Sample

    220110-scd1csefhk

Malware Config

Extracted

Family

cryptbot

C2

kotoeu12.top

morkve01.top

Attributes
  • payload_url

    http://okapia01.top/download.php?file=targia.exe

Extracted

Family

raccoon

Version

1.8.4-hotfixs

rc4.plain

Targets

    • Target

      https://www.youtube.com/watch?v=U7MxPq1i_nI

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks