Resubmissions

14-11-2022 12:34

221114-pr4msahf27 10

14-11-2022 09:44

221114-lqklqsge48 10

General

  • Target

    242b050cc122233e783283296a736b689acfb116c68047c52252a012ba322499.zip

  • Size

    2MB

  • Sample

    221114-pr4msahf27

  • MD5

    ca8ba9678740a88b7ea1be1dd2945700

  • SHA1

    b40ac89c4913e281afd07a9f6ab9065491f07817

  • SHA256

    24dc074176cdd1b4d8159333443508a5a45160f6e1f75b5bd9f5824f2fda51ed

  • SHA512

    3aeeb4bc5c18105ce58c17c306729d6a4ec2a85d698e5fa9bd6177cff0d40f8e62c44900f88c489bf711e4397588ea4cb3ce6752c31e690e499b12e19988e7d1

  • SSDEEP

    49152:kcKrcU6nLGsbcGVWhWfhyxnZg1aFWP7ljTM7zXH1iitjUNomGzseBn2:hKrcU6nL3xDyVHkPxjTM7z38MjUNJmB2

Malware Config

Extracted

Family

nullmixer

C2

http://sokiran.xyz/

Extracted

Family

vidar

Version

39.6

Botnet

933

C2

https://sslamlssa1.tumblr.com/

Attributes
  • profile_id

    933

Extracted

Family

nymaim

C2

45.139.105.171

85.31.46.167

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Targets

    • Target

      242b050cc122233e783283296a736b689acfb116c68047c52252a012ba322499.exe

    • Size

      2MB

    • MD5

      70800f0e430d4c9ae411aa87ef26870d

    • SHA1

      ae3108303791bf71f3d8a22a81950f56d064ec60

    • SHA256

      242b050cc122233e783283296a736b689acfb116c68047c52252a012ba322499

    • SHA512

      1746b4407479ab721c7df75bce318fc0251154732e988bd92a65a686da20f71cd7f9705e5a37bf939f4aa5bc64a722b8a73465c58517dc254377a28d20ac2c4c

    • SSDEEP

      49152:xcBOPkZVi7iKiF8cUvFyPIbUgwvnJTn13QTNyfk5u4ocZ12EwJ84vLRaBtIl9mTO:xsri7ixZUvFyPIbYvnZnpQocu4xZ1FC3

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detect Fabookie payload

    • Detects Smokeloader packer

    • Fabookie

      Fabookie is facebook account info stealer.

    • Modifies Windows Defender Real-time Protection settings

    • NullMixer

      NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Nirsoft

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Creates new service(s)

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Uses the VBS compiler for execution

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Modify Existing Service

2
T1031

New Service

1
T1050

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

New Service

1
T1050

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

4
T1112

Disabling Security Tools

1
T1089

Scripting

1
T1064

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Tasks