General
-
Target
https://www.nu6i-bg-net.com/%D0%B2-%D1%81%D1%8A%D1%80%D1%86%D0%B5%D1%82%D0%BE-%D0%BD%D0%B0-%D0%BC%D0%B0%D1%88%D0%B8%D0%BD%D0%B0%D1%82%D0%B0-in-the-heart-of-the-machine-2022-%D0%BE%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD-%D1%84%D0%B8_3dad8908e.html
-
Sample
221215-wltnysda27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.nu6i-bg-net.com/%D0%B2-%D1%81%D1%8A%D1%80%D1%86%D0%B5%D1%82%D0%BE-%D0%BD%D0%B0-%D0%BC%D0%B0%D1%88%D0%B8%D0%BD%D0%B0%D1%82%D0%B0-in-the-heart-of-the-machine-2022-%D0%BE%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD-%D1%84%D0%B8_3dad8908e.html
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
https://www.nu6i-bg-net.com/%D0%B2-%D1%81%D1%8A%D1%80%D1%86%D0%B5%D1%82%D0%BE-%D0%BD%D0%B0-%D0%BC%D0%B0%D1%88%D0%B8%D0%BD%D0%B0%D1%82%D0%B0-in-the-heart-of-the-machine-2022-%D0%BE%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD-%D1%84%D0%B8_3dad8908e.html
Resource
win7-20221111-en
Behavioral task
behavioral3
Sample
https://www.nu6i-bg-net.com/%D0%B2-%D1%81%D1%8A%D1%80%D1%86%D0%B5%D1%82%D0%BE-%D0%BD%D0%B0-%D0%BC%D0%B0%D1%88%D0%B8%D0%BD%D0%B0%D1%82%D0%B0-in-the-heart-of-the-machine-2022-%D0%BE%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD-%D1%84%D0%B8_3dad8908e.html
Resource
win10v2004-20221111-en
Malware Config
Extracted
raccoon
d87b51d1771107cfddb7c7acd7727950
http://147.135.62.201/
Targets
-
-
Target
https://www.nu6i-bg-net.com/%D0%B2-%D1%81%D1%8A%D1%80%D1%86%D0%B5%D1%82%D0%BE-%D0%BD%D0%B0-%D0%BC%D0%B0%D1%88%D0%B8%D0%BD%D0%B0%D1%82%D0%B0-in-the-heart-of-the-machine-2022-%D0%BE%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD-%D1%84%D0%B8_3dad8908e.html
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash
-