Malware sandboxing report by Hatching Triage

General

Target

3aa947c9f9eafb67064ea9cf2f0d1ec335a301a81e89f24faefefec3f6a0a2a3
Size

6MB
Sample

220625-ctqsgscgd4
MD5

53d975d90d5f53f85d40b3cc53d6a5dc
SHA1

0495c475914d3a3278c33c0f93a84cd05d07bf40
SHA256

3aa947c9f9eafb67064ea9cf2f0d1ec335a301a81e89f24faefefec3f6a0a2a3
SHA512

a65d26fb9aa5c5235905a0f14d373d1de90a00118a814b096b1ab514668e4a48ae5366d07d1341f9fe06fd564fc8df8683bf4bad3e0eb82feca36eb6757ebd27

Score

10^/10

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

vidar

Version

41.6

Botnet

933

C2

https://mas.to/@lilocc

Attributes

profile_id
933

Targets

- Target
  
  3aa947c9f9eafb67064ea9cf2f0d1ec335a301a81e89f24faefefec3f6a0a2a3
- Size
  
  6MB
- MD5
  
  53d975d90d5f53f85d40b3cc53d6a5dc
- SHA1
  
  0495c475914d3a3278c33c0f93a84cd05d07bf40
- SHA256
  
  3aa947c9f9eafb67064ea9cf2f0d1ec335a301a81e89f24faefefec3f6a0a2a3
- SHA512
  
  a65d26fb9aa5c5235905a0f14d373d1de90a00118a814b096b1ab514668e4a48ae5366d07d1341f9fe06fd564fc8df8683bf4bad3e0eb82feca36eb6757ebd27
Score

10^/10

onlylogger socelars vidar discovery loader stealer 933 spyware
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars Payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- OnlyLogger Payload
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops Chrome extension
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2