General
-
Target
27425AB21814ACDC92665957CE92F326A46EA99131EF3.exe
-
Size
2.5MB
-
Sample
221004-y4zc9scdb5
-
MD5
3e04b8ba6cbccb22f3a1cbb98b092990
-
SHA1
ce6176c44798b5104f87c8f37330041f7911b97f
-
SHA256
27425ab21814acdc92665957ce92f326a46ea99131ef32df83ccaeaaa5228c20
-
SHA512
8c1c8ac110c9aa43412d5569e20239704c53268b33ba88b74f8d85f00dc07fb8291d85937bcfe2459e0f54a1bbbde2f966057aff34a012a77350d86bb7c5641f
-
SSDEEP
49152:EggBDSuw1VkMpraG6d23GG49DSP4FDHhJaO69QGnMg4PPqZi5r:JxVVjsd2Z/AlNq9MgcPH5r
Static task
static1
Behavioral task
behavioral1
Sample
27425AB21814ACDC92665957CE92F326A46EA99131EF3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
27425AB21814ACDC92665957CE92F326A46EA99131EF3.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
nullmixer
http://sokiran.xyz/
Extracted
vidar
39.6
933
https://sslamlssa1.tumblr.com/
-
profile_id
933
Extracted
nymaim
208.67.104.97
85.31.46.167
Extracted
vidar
54.9
1679
https://t.me/larsenup
https://ioc.exchange/@zebra54
-
profile_id
1679
Extracted
raccoon
f65d012b021e6e8fcaa9c1a04b6d5107
http://64.44.102.241
http://64.44.102.116
Targets
-
-
Target
27425AB21814ACDC92665957CE92F326A46EA99131EF3.exe
-
Size
2.5MB
-
MD5
3e04b8ba6cbccb22f3a1cbb98b092990
-
SHA1
ce6176c44798b5104f87c8f37330041f7911b97f
-
SHA256
27425ab21814acdc92665957ce92f326a46ea99131ef32df83ccaeaaa5228c20
-
SHA512
8c1c8ac110c9aa43412d5569e20239704c53268b33ba88b74f8d85f00dc07fb8291d85937bcfe2459e0f54a1bbbde2f966057aff34a012a77350d86bb7c5641f
-
SSDEEP
49152:EggBDSuw1VkMpraG6d23GG49DSP4FDHhJaO69QGnMg4PPqZi5r:JxVVjsd2Z/AlNq9MgcPH5r
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detects Smokeloader packer
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Vidar Stealer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Modifies file permissions
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Modify Registry
3Disabling Security Tools
1Virtualization/Sandbox Evasion
1File Permissions Modification
1Scripting
1Install Root Certificate
1