Resubmissions

12-02-2022 15:20

220212-sq2ctachc2 10

12-02-2022 15:04

220212-sfsb6aefgj 10

04-02-2022 09:51

220204-lvssxaggb4 10

03-02-2022 13:01

220203-p9hs2ahdf5 10

03-02-2022 12:59

220203-p763vahdd6 1

01-02-2022 13:19

220201-qkgecaegep 10

31-01-2022 12:34

220131-pr7z7shgb5 10

30-01-2022 09:16

220130-k8fvtshfgp 10

27-01-2022 09:40

220127-lnhdlaagh7 10

General

  • Target

    b002c0162a0a0c83be1ebdb21c14c580.exe

  • Size

    6.6MB

  • Sample

    220204-lvssxaggb4

  • MD5

    b002c0162a0a0c83be1ebdb21c14c580

  • SHA1

    96d424d27ead82288ef68fb02e7a7205a4254068

  • SHA256

    ea2aba1a17de28fee1a6097e91c4ceb0f3887f6bbcce46dfe4d2e342b87bef9e

  • SHA512

    7df2fd40b14992ea1a09a9efc61ae91c2e5fe49272855dc00542096070a6804fd1e06d0978f39c8fa1d35af51b4c4cb2ff66674e29da8cb82076bbb0ef5b371c

Malware Config

Extracted

Family

socelars

C2

http://www.kvubgc.com/

Extracted

Family

redline

Botnet

Update

C2

78.46.137.240:21314

Extracted

Family

redline

Botnet

v2user1

C2

88.99.35.59:63020

Extracted

Family

redline

Botnet

media17223

C2

92.255.57.115:59426

Extracted

Family

smokeloader

Version

2020

C2

http://nahbleiben.at/upload/

http://noblecreativeaz.com/upload/

http://tvqaq.cn/upload/

http://recmaster.ru/upload/

http://sovels.ru/upload/

rc4.i32
rc4.i32

Targets

    • Target

      b002c0162a0a0c83be1ebdb21c14c580.exe

    • Size

      6.6MB

    • MD5

      b002c0162a0a0c83be1ebdb21c14c580

    • SHA1

      96d424d27ead82288ef68fb02e7a7205a4254068

    • SHA256

      ea2aba1a17de28fee1a6097e91c4ceb0f3887f6bbcce46dfe4d2e342b87bef9e

    • SHA512

      7df2fd40b14992ea1a09a9efc61ae91c2e5fe49272855dc00542096070a6804fd1e06d0978f39c8fa1d35af51b4c4cb2ff66674e29da8cb82076bbb0ef5b371c

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars Payload

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • OnlyLogger Payload

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks