General

  • Target

    5f89fd10da2f75c1fab37f3379a779829f26379b3fbfa8742ee85819d11e5acc

  • Size

    6.6MB

  • Sample

    220731-ncawgseefr

  • MD5

    84991792690dd5cfabca291c71553cd7

  • SHA1

    3b7b0cc62632bd37c6cd934de7ae4f8b73f7533c

  • SHA256

    5f89fd10da2f75c1fab37f3379a779829f26379b3fbfa8742ee85819d11e5acc

  • SHA512

    b38d2fccc3d64ad19089ceeefb1f6033e8f32c05a7af8bb62d574323846de05b3f0889e5385450d559ec23e49742f347e7210095d23b4a6f826aaf23f0eaf2f6

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

vidar

Version

41.6

Botnet

933

C2

https://mas.to/@lilocc

Attributes
  • profile_id

    933

Targets

    • Target

      5f89fd10da2f75c1fab37f3379a779829f26379b3fbfa8742ee85819d11e5acc

    • Size

      6.6MB

    • MD5

      84991792690dd5cfabca291c71553cd7

    • SHA1

      3b7b0cc62632bd37c6cd934de7ae4f8b73f7533c

    • SHA256

      5f89fd10da2f75c1fab37f3379a779829f26379b3fbfa8742ee85819d11e5acc

    • SHA512

      b38d2fccc3d64ad19089ceeefb1f6033e8f32c05a7af8bb62d574323846de05b3f0889e5385450d559ec23e49742f347e7210095d23b4a6f826aaf23f0eaf2f6

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • OnlyLogger payload

    • Vidar Stealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Network Service Scanning

1
T1046

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks