Resubmissions

11-09-2022 15:09

220911-sjhl5afegm 10

11-09-2022 14:54

220911-sadxksbgh5 10

11-09-2022 08:20

220911-j8xmxabcf2 10

General

  • Target

    0e14021b3594a5a54254d4f1cdf374dcf6650d71111f3dcf616f7043d7b2fba3.exe

  • Size

    466.4MB

  • Sample

    220911-sadxksbgh5

  • MD5

    cc80d2004e569eb4e2cfd21af2fe860c

  • SHA1

    a57521c3624367785378c3e68e455f1d41e4e100

  • SHA256

    0e14021b3594a5a54254d4f1cdf374dcf6650d71111f3dcf616f7043d7b2fba3

  • SHA512

    746ee3366d6e0bb704fcb2403d712f7fc7973736d6c3ebf1b06aaa2d9f7bf687ad206d4d64247e648d16d2ecaa6e33c75884c89b2382e43570739043a455b3c9

  • SSDEEP

    98304:EuEUv6x2NrM0HgXPMWw7Ci7jv/H0wp4k5FzAoME9F56QqF:EAv6QNQ0ukW5Uj/xSk5F2rh

Malware Config

Extracted

Family

privateloader

C2

http://163.123.143.4/proxies.txt

http://107.182.129.251/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

163.123.143.12

http://91.241.19.125/pub.php?pub=one

http://sarfoods.com/index.php

Attributes
  • payload_url

    https://vipsofts.xyz/files/mega.bmp

Extracted

Family

redline

Botnet

nam6.2

C2

103.89.90.61:34589

Attributes
  • auth_value

    4040fe7c77de89cf1a6f4cebd515c54c

Extracted

Family

redline

Botnet

4

C2

79.110.62.196:26277

Attributes
  • auth_value

    e48cb0b64e920bb1a534eba5b2912707

Extracted

Family

redline

C2

20.111.62.187:12944

Attributes
  • auth_value

    dc69bbc8bdf611480705ba6c6d8c091b

Extracted

Family

redline

Botnet

ruzki13

C2

176.113.115.146:9582

Attributes
  • auth_value

    e58a088bb451fbf3619de77d5856234c

Extracted

Family

redline

Botnet

3108_RUZKI

C2

213.219.247.199:9452

Attributes
  • auth_value

    f71fed1cd094e4e1eb7ad1c53e542bca

Extracted

Family

raccoon

Botnet

80cbdb8d66d1a00e163a1094a224c8cf

C2

http://89.185.85.53/

rc4.plain

Targets

    • Target

      0e14021b3594a5a54254d4f1cdf374dcf6650d71111f3dcf616f7043d7b2fba3.exe

    • Size

      466.4MB

    • MD5

      cc80d2004e569eb4e2cfd21af2fe860c

    • SHA1

      a57521c3624367785378c3e68e455f1d41e4e100

    • SHA256

      0e14021b3594a5a54254d4f1cdf374dcf6650d71111f3dcf616f7043d7b2fba3

    • SHA512

      746ee3366d6e0bb704fcb2403d712f7fc7973736d6c3ebf1b06aaa2d9f7bf687ad206d4d64247e648d16d2ecaa6e33c75884c89b2382e43570739043a455b3c9

    • SSDEEP

      98304:EuEUv6x2NrM0HgXPMWw7Ci7jv/H0wp4k5FzAoME9F56QqF:EAv6QNQ0ukW5Uj/xSk5F2rh

    • Detects Smokeloader packer

    • Modifies Windows Defender Real-time Protection settings

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Command-Line Interface

1
T1059

Persistence

Modify Existing Service

1
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Disabling Security Tools

1
T1089

Virtualization/Sandbox Evasion

1
T1497

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

7
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

8
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

2
T1005

Tasks