Overview

overview

10

Static

static

sample.exe

windows7_x64

10

sample.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sample.exe

  • Size

    14.6MB

  • Sample

    220303-n1gc6sbbb8

  • MD5

    72d2e91a70f1125537202add8d58a929

  • SHA1

    95c936fd1bc39d79f9e01dadde215c44d52da3be

  • SHA256

    6c23796649cdb2fade0e3af9e7a4bc59b420db7f5e25144daff0c7cbc2bef52a

  • SHA512

    67ad4a19451c2bf159d190db5c332800c853c0c384d7c790b218c434a90d06ce1e12f884da0e110ab0bc9d4e78477f9e3b049eb87228cb4aac815d92ed8bb8af

Score
10/10
djvuonlyloggerredlinesocelarsvidar333333@tuifullwork1488media9testmix2aspackv2discoveryevasioninfostealerloaderransomwarestealertrojan

Malware Config

Extracted

Family

socelars

C2

http://www.wgqpw.com/

Extracted

Family

redline

Botnet

media9test

C2

65.108.69.168:16278

Attributes
  • auth_value

    ec94870f0060e8fdc20281ad93685f77

Extracted

Family

redline

Botnet

@Tui

C2

185.215.113.44:23759

Attributes
  • auth_value

    f4763503fd39f2719d3cbb75871d93ad

Extracted

Family

redline

C2

45.132.1.57:15771

Attributes
  • auth_value

    9d006a439ab657f87bacd7a8c5f366b6

Extracted

Family

redline

Botnet

333333

C2

31.210.20.42:13040

Attributes
  • auth_value

    3efa022bc816f747304fd68e5810bb78

Extracted

Family

redline

Botnet

fullwork1488

C2

91.243.32.165:41754

Attributes
  • auth_value

    a4384deb7b09a3c1c21c6447924c2d9a

Extracted

Family

redline

Botnet

MIX2

C2

45.132.1.57:15771

Attributes
  • auth_value

    f5efeb0fa57eb56935fd3ba6d5750a9d

Targets

    • Target

      sample.exe

    • Size

      14.6MB

    • MD5

      72d2e91a70f1125537202add8d58a929

    • SHA1

      95c936fd1bc39d79f9e01dadde215c44d52da3be

    • SHA256

      6c23796649cdb2fade0e3af9e7a4bc59b420db7f5e25144daff0c7cbc2bef52a

    • SHA512

      67ad4a19451c2bf159d190db5c332800c853c0c384d7c790b218c434a90d06ce1e12f884da0e110ab0bc9d4e78477f9e3b049eb87228cb4aac815d92ed8bb8af

    Score
    10/10
    socelarsaspackv2stealerdjvuonlyloggerredlinevidar333333@tuifullwork1488media9testmix2discoveryevasioninfostealerloaderransomwaretrojan

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

      ransomwaredjvu

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

      loaderonlylogger

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

      stealersocelars

    • Socelars Payload

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • OnlyLogger Payload

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

File Permissions Modification

1
T1222

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Process Discovery

1
T1057

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks