Overview

overview

10

Static

static

winprofile

windows7_x64

10

winprofile

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    502f0a6587cf2d084e98f5edc12192e1ca37515bdf7364511415d615be2e6aa7

  • Size

    65KB

  • Sample

    220621-ed7r6sdad6

  • MD5

    53dec7a3a6418bbc55d20e40e97a224c

  • SHA1

    b6427092966218261138ad15a911f4cca5d9a69b

  • SHA256

    502f0a6587cf2d084e98f5edc12192e1ca37515bdf7364511415d615be2e6aa7

  • SHA512

    3f350abd77595b6e31b91448e1fc3d3a24e331b1496f8d3d90d32e99f94ac2cd0d72b9533d20d9a17d8e5a903b7908a987bee884b8b0ebdecb51be72947bc16f

Score
10/10
arkeirecordbreakerdefaultdiscoveryspywarestealersuricata

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://timekeeper.ug/ppx.ps1

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://boundertime.ru/pps.ps1

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://timebounder.ru/pps.ps1

Extracted

Family

recordbreaker

C2

http://136.244.65.99/

http://140.82.52.55/

Extracted

Family

arkei

Botnet

Default

Targets

    • Target

      502f0a6587cf2d084e98f5edc12192e1ca37515bdf7364511415d615be2e6aa7

    • Size

      65KB

    • MD5

      53dec7a3a6418bbc55d20e40e97a224c

    • SHA1

      b6427092966218261138ad15a911f4cca5d9a69b

    • SHA256

      502f0a6587cf2d084e98f5edc12192e1ca37515bdf7364511415d615be2e6aa7

    • SHA512

      3f350abd77595b6e31b91448e1fc3d3a24e331b1496f8d3d90d32e99f94ac2cd0d72b9533d20d9a17d8e5a903b7908a987bee884b8b0ebdecb51be72947bc16f

    Score
    10/10
    arkeirecordbreakerdefaultdiscoveryspywarestealersuricata

    • Arkei

      Arkei is an infostealer written in C++.

      stealerarkei

    • Raccoon ver2

      Raccoon ver2.

    • RecordBreaker

      RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

      stealerrecordbreaker

    • suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4

      suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4

      suricata

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

      suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

      suricata

    • suricata: ET MALWARE Windows executable base64 encoded

      suricata: ET MALWARE Windows executable base64 encoded

      suricata

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks