General

  • Target

    9063dd7d69236cca3007587ccc04334b4289ec456f6983673f3d9f749092a29c

  • Size

    905KB

  • Sample

    221128-epxrcade62

  • MD5

    94303719e275a63241a5797e74c25fb4

  • SHA1

    1240b73d60632e545d0bcc6d91e632fffaa99172

  • SHA256

    529c826eef5d27134636643d9893f3a93b6cd050a05b066b2e62190f1525d936

  • SHA512

    86861687bfa2bb41bf6da188a747371f1ffcdabdee65c9c88856cf68ee0a49ec28e461e8222e1ca0af6ce51c6e1d9408ac145509c5ca61e101320bc9df72b52f

  • SSDEEP

    12288:9nC9Na/vMINcxDBwSXEwsoJKr90uCIUXnOV/vqFalrSZx9exK94p/BwXN4oDrfBn:0/aXM/IDoguOnVE41p/+XN4+pM/OpJ

Malware Config

Extracted

Family

raccoon

Botnet

5d704573a0f97fb52a93667085c18b77

C2

http://193.106.191.150/

rc4.plain

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

remcos

Botnet

11262022

C2

nikahuve.ac.ug:65214

kalskala.ac.ug:65214

tuekisaa.ac.ug:65214

parthaha.ac.ug:65214

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    vbfxs.dat

  • keylog_flag

    false

  • keylog_folder

    fsscbas

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    dchfgsdmhj-JWMVH4

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Targets

    • Target

      9063dd7d69236cca3007587ccc04334b4289ec456f6983673f3d9f749092a29c

    • Size

      914KB

    • MD5

      6ef647cfe131f11e48e3acfd2b52595d

    • SHA1

      27a369afc3127e58c968c4ea07a69c3e0053e8db

    • SHA256

      9063dd7d69236cca3007587ccc04334b4289ec456f6983673f3d9f749092a29c

    • SHA512

      ca65119068e2f5a13700971d69cecddf56266dbe4ba0a45654a15a9254909e6997cc8a9b16c51b406dcbd45da22b3798d50550ea89cf741b9f6f2a4c2a316b05

    • SSDEEP

      24576:3QGX47KXoN7mu8x65nf861hFPV+XN4spG/Ojx:HI72oNL8x65nf860c/Oj

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Tasks