General

  • Target

    Chaos 2.0.zip

  • Size

    6.2MB

  • Sample

    220317-xd58fsedcm

  • MD5

    3569ac6e04296e88444d7ecf799c71b7

  • SHA1

    79a7f1e0fed008058afa803bdcf3172379808309

  • SHA256

    1cb6869826cf5ea749658c7622c8b4ecbcbb5c5e167ebc6623a01a0e0483e0f7

  • SHA512

    3de27b865db8ae753ca012771c71ca5e49e83aa4ebbac339938f722cb04c276a09925c759e0eaacaa842e69fb90ec7fb23e77a6411d2b1bc9d0f7b352f8091c8

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.xxhufdc.top/

http://www.uefhkice.xyz/

http://www.fcektsy.top/

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

ANI

C2

45.142.215.47:27643

Targets

    • Target

      setup_x86_x64_install.exe

    • Size

      6.2MB

    • MD5

      d2f0cfac1c354f041c7b243f3df94d0a

    • SHA1

      dfc03d06e799018485dc2dd72f997a0fef3d83a1

    • SHA256

      3faadb2356253a3c76b42691c13dd3c05b0df75fbf543041bd7afc478b9a838c

    • SHA512

      ed4b434001a16e0d81d59a5be9a26d31be8fb518ddc9e98dd22ca031761ab88ec9d4d479f11b2c0febfb90960061159836c806952d9e0c5cf9239654a5b7e6d6

    • Modifies Windows Defender Real-time Protection settings

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

    • RedLine

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Socelars

    • Socelars Payload

    • suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

      suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

    • OnlyLogger Payload

    • Smokeloader2018

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

Modify Registry

1
T1112

Disabling Security Tools

1
T1089

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks