General

  • Target

    file.exe

  • Size

    4.8MB

  • Sample

    230129-yzdwrsdc8t

  • MD5

    29606bb4d0af0ed8ee159922f063b8ab

  • SHA1

    308dfda5bd0d073a4f7eb908c3917ee46a390b0f

  • SHA256

    47441e1d63c39f1ef422b3b073c68e8ad740070404c9a2f0c5e9e3910440092e

  • SHA512

    07091bdd582e3ffab8aabd8767ba400e408df569cd01fa45d05f35961f99d9cc83f405750c4fbde17a81b41e63ab7b7d67e1879351656ecc54850488925eed18

  • SSDEEP

    98304:vW1nSmKwhJIRoPEcWGf6MWo6uImWU8fqAqB7lZEeKb5xDq1sYDiMbpPS:u82JkoVJImWh6B7lZEeKe1sY+MbpS

Malware Config

Extracted

Family

amadey

Version

3.65

C2

77.73.134.27/8bmdh3Slb2/index.php

Extracted

Family

raccoon

Botnet

04f8fa0bf52b1b98a127f6deeac54f84

C2

http://94.131.3.70/

http://83.217.11.11/

http://83.217.11.13/

http://83.217.11.14/

http://45.15.156.222/

rc4.plain

Targets

    • Target

      file.exe

    • Size

      4.8MB

    • MD5

      29606bb4d0af0ed8ee159922f063b8ab

    • SHA1

      308dfda5bd0d073a4f7eb908c3917ee46a390b0f

    • SHA256

      47441e1d63c39f1ef422b3b073c68e8ad740070404c9a2f0c5e9e3910440092e

    • SHA512

      07091bdd582e3ffab8aabd8767ba400e408df569cd01fa45d05f35961f99d9cc83f405750c4fbde17a81b41e63ab7b7d67e1879351656ecc54850488925eed18

    • SSDEEP

      98304:vW1nSmKwhJIRoPEcWGf6MWo6uImWU8fqAqB7lZEeKb5xDq1sYDiMbpPS:u82JkoVJImWh6B7lZEeKe1sY+MbpS

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Detects Smokeloader packer

    • Modifies security service

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Stops running service(s)

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Modify Existing Service

2
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Impair Defenses

1
T1562

Scripting

1
T1064

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Email Collection

2
T1114

Command and Control

Web Service

1
T1102

Impact

Service Stop

1
T1489

Tasks