Overview

overview

10

Static

static

7

f0f7436b9d...0c.exe

windows7-x64

10

f0f7436b9d...0c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f0f7436b9d5a284db8dadd62f5c1430c

  • Size

    3.7MB

  • Sample

    220830-lzjqssfcam

  • MD5

    f0f7436b9d5a284db8dadd62f5c1430c

  • SHA1

    19246502e9b3621f0af8a143520cc66c01e87728

  • SHA256

    616cfd724afe8376aae36c9f065ebdf0a17590c0d1b71c95d6b1d960091807a6

  • SHA512

    abbc3a60bc12739992896981e3e6294b3935da8bb9cc36d4afc6aeea39be7382b299eb0a3ea712000473a8c719d36d438287008ecd3954b346eec918badb4ff6

  • SSDEEP

    49152:371EJYi68SMMZvYwHw0bHtb1ZF5ESWmoJR4AIrHoPKzcRHSLhpbE4wvvC5nJ:xPz8/qww1bNb1ZFiSLjSKzyHSFpb9J

Score
10/10
nymaimprivateloaderredlinesmokeloadertofseexmrig@forceddd_lztnam6.2ruzkiruzki9backdoordiscoveryevasioninfostealerloaderminerpersistencespywarestealerthemidatrojanvmprotect

Malware Config

Extracted

Family

privateloader

C2

http://163.123.143.4/proxies.txt

http://107.182.129.251/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

163.123.143.12
Attributes
  • payload_url

    https://vipsofts.xyz/files/mega.bmp

Extracted

Family

redline

Botnet

ruzki

C2

185.241.54.113:31049

Attributes
  • auth_value

    beff5419044317cfc16dabbe118f4644

Extracted

Family

redline

Botnet

@forceddd_lzt

C2

5.182.36.101:31305

Attributes
  • auth_value

    91ffc3d776bc56b5c410d1adf5648512

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Extracted

Family

redline

Botnet

ruzki9

C2

176.113.115.146:9582

Attributes
  • auth_value

    0bc3fe6153667b0956cb33e6a376b53d

Extracted

Family

redline

Botnet

nam6.2

C2

103.89.90.61:34589

Attributes
  • auth_value

    2276f4d8810e679413659a9576a6cdf4

Targets

    • Target

      f0f7436b9d5a284db8dadd62f5c1430c

    • Size

      3.7MB

    • MD5

      f0f7436b9d5a284db8dadd62f5c1430c

    • SHA1

      19246502e9b3621f0af8a143520cc66c01e87728

    • SHA256

      616cfd724afe8376aae36c9f065ebdf0a17590c0d1b71c95d6b1d960091807a6

    • SHA512

      abbc3a60bc12739992896981e3e6294b3935da8bb9cc36d4afc6aeea39be7382b299eb0a3ea712000473a8c719d36d438287008ecd3954b346eec918badb4ff6

    • SSDEEP

      49152:371EJYi68SMMZvYwHw0bHtb1ZF5ESWmoJR4AIrHoPKzcRHSLhpbE4wvvC5nJ:xPz8/qww1bNb1ZFiSLjSKzyHSFpb9J

    Score
    10/10
    nymaimprivateloaderredlinesmokeloadertofseexmrig@forceddd_lztruzkiruzki9backdoordiscoveryevasioninfostealerloaderminerpersistencespywarestealerthemidatrojanvmprotectnam6.2

    • Detects Smokeloader packer

    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

      trojannymaim

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • XMRig Miner payload

      miner

    • Creates new service(s)

      persistence

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

New Service

1
T1050

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

6
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

6
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks