Malware sandboxing report by Hatching Triage

Sharing

Copy URL

Twitter E-mail

General

Target

6E52D162BAF265E070EC1A3147AD651D8BD8481D96B33.exe
Size

3MB
Sample

220112-apgynsacb4
MD5

defafd07d253ff3e67f6bb04d59b125c
SHA1

9ac9b2bea4507031b79db57c5fe3856bf1900d69
SHA256

6e52d162baf265e070ec1a3147ad651d8bd8481d96b33cee1b89d84e9c92c5f3
SHA512

f654fe4ae503ca459ca9c261a6f76b08ca14a5e807785ebc5f13f3a7d8290e45cc3d1c987c7edc091acff9624d0e2caf8d4dac9f8d26d7ab0699aacba47db4b8

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

fucker2

135.181.129.119:4805

Extracted

Family

redline

Botnet

media18

91.121.67.60:2151

Targets

- Target
  
  6E52D162BAF265E070EC1A3147AD651D8BD8481D96B33.exe
- Size
  
  3MB
- MD5
  
  defafd07d253ff3e67f6bb04d59b125c
- SHA1
  
  9ac9b2bea4507031b79db57c5fe3856bf1900d69
- SHA256
  
  6e52d162baf265e070ec1a3147ad651d8bd8481d96b33cee1b89d84e9c92c5f3
- SHA512
  
  f654fe4ae503ca459ca9c261a6f76b08ca14a5e807785ebc5f13f3a7d8290e45cc3d1c987c7edc091acff9624d0e2caf8d4dac9f8d26d7ab0699aacba47db4b8
Score

10^/10

redline smokeloader fucker2 media18 aspackv2 backdoor evasion infostealer spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Collection

Data from Local System

T1005

Command and Control

Credential Access

Credentials in Files

T1081

Defense Evasion

Disabling Security Tools

T1089

Web Service

T1102

Modify Registry

T1112

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Modify Existing Service

T1031

Privilege Escalation

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Targets

Modifies Windows Defender Real-time Protection settings

Process spawned unexpected child process

RedLine

RedLine Payload

SmokeLoader

Suspicious use of NtCreateUserProcessOtherParentProcess

ASPack v2.12-2.42

Downloads MZ/PE file

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2