General

  • Target

    24D4DAEDBA9B8060BF0D09B4383849B69E8D1741C3FFA.exe

  • Size

    7.1MB

  • Sample

    220520-wnk5labdg3

  • MD5

    8ac2aa386d2ab6edb792785243dbde6b

  • SHA1

    69680a99121d56023816bd8cb7218d0a320b8745

  • SHA256

    24d4daedba9b8060bf0d09b4383849b69e8d1741c3ffaad8156ab8cfa56f8625

  • SHA512

    5dec0c8cd026b585575dcd8ba85d4ad7b137c5131928b20c316714b92558a98726b6d082318091a8c6a989c5450ec57be8e1580936a4b9e3104e1b165b544f75

Malware Config

Extracted

Family

socelars

C2

http://www.biohazardgraphics.com/

Extracted

Family

redline

Botnet

media24pns

C2

65.108.69.168:13293

Attributes
  • auth_value

    f4347dfa36c469293073389229d591a9

Extracted

Family

redline

Botnet

userv1

C2

159.69.246.184:13127

Attributes
  • auth_value

    1c36bfa23099b197f07410a64d4c862e

Targets

    • Target

      24D4DAEDBA9B8060BF0D09B4383849B69E8D1741C3FFA.exe

    • Size

      7.1MB

    • MD5

      8ac2aa386d2ab6edb792785243dbde6b

    • SHA1

      69680a99121d56023816bd8cb7218d0a320b8745

    • SHA256

      24d4daedba9b8060bf0d09b4383849b69e8d1741c3ffaad8156ab8cfa56f8625

    • SHA512

      5dec0c8cd026b585575dcd8ba85d4ad7b137c5131928b20c316714b92558a98726b6d082318091a8c6a989c5450ec57be8e1580936a4b9e3104e1b165b544f75

    • Modifies Windows Defender Real-time Protection settings

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars Payload

    • suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

      suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • OnlyLogger Payload

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

Modify Registry

2
T1112

Disabling Security Tools

1
T1089

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks