General

  • Target

    34ae2634a918f2d9e3ca63b1769de798.exe

  • Size

    312KB

  • Sample

    220115-t1yv4segg7

  • MD5

    34ae2634a918f2d9e3ca63b1769de798

  • SHA1

    3cc2cc162afa1f80fc11564c431126cf1d7a9ead

  • SHA256

    03769cac805f961a9f35fb14545334783141efbb65387da3fe8f311a04cf1009

  • SHA512

    9a4cb7093d9f45c349b6ab572189d2097de5ea852a2195a5b9142eda52ebf5ddd9e73d25a3ce07a8f671e19c2425fdcf8d07d6acf6dd0d33607ef1e1cd79d306

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Extracted

Family

tofsee

C2

patmushta.info

parubey.info

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:34865

Extracted

Family

vidar

Version

49.6

Botnet

916

C2

https://noc.social/@banda5ker

https://mastodon.social/@banda6ker

Attributes
  • profile_id

    916

Targets

    • Target

      34ae2634a918f2d9e3ca63b1769de798.exe

    • Size

      312KB

    • MD5

      34ae2634a918f2d9e3ca63b1769de798

    • SHA1

      3cc2cc162afa1f80fc11564c431126cf1d7a9ead

    • SHA256

      03769cac805f961a9f35fb14545334783141efbb65387da3fe8f311a04cf1009

    • SHA512

      9a4cb7093d9f45c349b6ab572189d2097de5ea852a2195a5b9142eda52ebf5ddd9e73d25a3ce07a8f671e19c2425fdcf8d07d6acf6dd0d33607ef1e1cd79d306

    • Arkei

      Arkei is an infostealer written in C++.

    • Modifies WinLogon for persistence

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Windows security bypass

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Arkei Stealer Payload

    • Vidar Stealer

    • XMRig Miner Payload

    • Creates new service(s)

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Installed Components in the registry

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks