General

  • Target

    c7d7ec2e4a57e6cb347b37637dbd53b3abfecd4ebc3a296b5e4dc7b614d0b867

  • Size

    188KB

  • Sample

    220923-rkjedahba4

  • MD5

    5e4d4bd0940bf442a5eb6c0cdd327b5c

  • SHA1

    e98315e9943f70478e0f2d51d7d7720f254687cc

  • SHA256

    c7d7ec2e4a57e6cb347b37637dbd53b3abfecd4ebc3a296b5e4dc7b614d0b867

  • SHA512

    8a5771154e19cf92c8b759aad578a00bd43573c09ecb50ed5222351f9a78a334e53ef7dcd80814cc22c1e1bc242294ae827a39cc2b5be9e154a36c95473673ca

  • SSDEEP

    3072:zy6/wlTLhOZiMlG54YUygKzeMkSiVSqQeBZ1LQ0J/PkK4n:erLsiMlvYUxKzTeVSPKL

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Sup: @mr_golds)

C2

77.73.134.27:8163

Attributes
  • auth_value

    56c6f7b9024c076f0a96931453da7e56

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Targets

    • Target

      c7d7ec2e4a57e6cb347b37637dbd53b3abfecd4ebc3a296b5e4dc7b614d0b867

    • Size

      188KB

    • MD5

      5e4d4bd0940bf442a5eb6c0cdd327b5c

    • SHA1

      e98315e9943f70478e0f2d51d7d7720f254687cc

    • SHA256

      c7d7ec2e4a57e6cb347b37637dbd53b3abfecd4ebc3a296b5e4dc7b614d0b867

    • SHA512

      8a5771154e19cf92c8b759aad578a00bd43573c09ecb50ed5222351f9a78a334e53ef7dcd80814cc22c1e1bc242294ae827a39cc2b5be9e154a36c95473673ca

    • SSDEEP

      3072:zy6/wlTLhOZiMlG54YUygKzeMkSiVSqQeBZ1LQ0J/PkK4n:erLsiMlvYUxKzTeVSPKL

    • Detects Smokeloader packer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Creates new service(s)

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

New Service

1
T1050

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Tasks