General

  • Target

    a89d739e39a746fa53b4ace09ccc5ed7a4cd8bd522034aa953ec2892d374124d.bin

  • Size

    207KB

  • Sample

    220617-w991vafeb7

  • MD5

    04abca366cc648a461c1eee9a883bd12

  • SHA1

    889beaf9e13cfdc0d103c232c9a68c3febdbafaf

  • SHA256

    a89d739e39a746fa53b4ace09ccc5ed7a4cd8bd522034aa953ec2892d374124d

  • SHA512

    59ceed9b7cd95578200f7ffd749ff60e468784d29aee4f51510cda48089b068d999bfea7cbc2232d44c4746329bf5ecea9ae4225476e314b70f8f63388408b3e

Malware Config

Extracted

Family

privateloader

C2

http://212.193.30.45/proxies.txt

http://212.193.30.29/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

212.193.30.21

http://45.144.225.57/server.txt

85.202.169.116

http://91.241.19.125/pub.php?pub=one

http://sarfoods.com/index.php

Attributes
  • payload_url

    https://vipsofts.xyz/files/mega.bmp

Extracted

Family

nymaim

C2

37.0.8.39

31.210.20.149

212.192.241.16

Extracted

Family

socelars

C2

https://sa-us-bucket.s3.us-east-2.amazonaws.com/eurfrsa613/

Targets

    • Target

      a89d739e39a746fa53b4ace09ccc5ed7a4cd8bd522034aa953ec2892d374124d.bin

    • Size

      207KB

    • MD5

      04abca366cc648a461c1eee9a883bd12

    • SHA1

      889beaf9e13cfdc0d103c232c9a68c3febdbafaf

    • SHA256

      a89d739e39a746fa53b4ace09ccc5ed7a4cd8bd522034aa953ec2892d374124d

    • SHA512

      59ceed9b7cd95578200f7ffd749ff60e468784d29aee4f51510cda48089b068d999bfea7cbc2232d44c4746329bf5ecea9ae4225476e314b70f8f63388408b3e

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Modifies Windows Defender Real-time Protection settings

    • Modifies security service

    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars Payload

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

      suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

    • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

      suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner Payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Possible privilege escalation attempt

    • Stops running service(s)

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

3
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

6
T1112

Disabling Security Tools

1
T1089

Impair Defenses

1
T1562

File Permissions Modification

1
T1222

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

5
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Process Discovery

1
T1057

Remote System Discovery

1
T1018

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Command and Control

Web Service

1
T1102

Impact

Service Stop

1
T1489

Tasks