General

  • Size

    14MB

  • Sample

    220303-n1gc6sbbb8

  • MD5

    72d2e91a70f1125537202add8d58a929

  • SHA1

    95c936fd1bc39d79f9e01dadde215c44d52da3be

  • SHA256

    6c23796649cdb2fade0e3af9e7a4bc59b420db7f5e25144daff0c7cbc2bef52a

  • SHA512

    67ad4a19451c2bf159d190db5c332800c853c0c384d7c790b218c434a90d06ce1e12f884da0e110ab0bc9d4e78477f9e3b049eb87228cb4aac815d92ed8bb8af

Malware Config

Extracted

Family

socelars

C2

http://www.wgqpw.com/

Extracted

Family

redline

Botnet

media9test

C2

65.108.69.168:16278

Attributes
auth_value
ec94870f0060e8fdc20281ad93685f77

Extracted

Family

redline

Botnet

@Tui

C2

185.215.113.44:23759

Attributes
auth_value
f4763503fd39f2719d3cbb75871d93ad

Extracted

Family

redline

C2

45.132.1.57:15771

Attributes
auth_value
9d006a439ab657f87bacd7a8c5f366b6

Extracted

Family

redline

Botnet

333333

C2

31.210.20.42:13040

Attributes
auth_value
3efa022bc816f747304fd68e5810bb78

Extracted

Family

redline

Botnet

fullwork1488

C2

91.243.32.165:41754

Attributes
auth_value
a4384deb7b09a3c1c21c6447924c2d9a

Extracted

Family

redline

Botnet

MIX2

C2

45.132.1.57:15771

Attributes
auth_value
f5efeb0fa57eb56935fd3ba6d5750a9d

Targets

    • Target

      sample.exe

    • Size

      14MB

    • MD5

      72d2e91a70f1125537202add8d58a929

    • SHA1

      95c936fd1bc39d79f9e01dadde215c44d52da3be

    • SHA256

      6c23796649cdb2fade0e3af9e7a4bc59b420db7f5e25144daff0c7cbc2bef52a

    • SHA512

      67ad4a19451c2bf159d190db5c332800c853c0c384d7c790b218c434a90d06ce1e12f884da0e110ab0bc9d4e78477f9e3b049eb87228cb4aac815d92ed8bb8af

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars Payload

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • OnlyLogger Payload

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation