General

  • Target

    file

  • Size

    756KB

  • Sample

    230222-q12efsbh42

  • MD5

    a9926757f1a1882142e369cc4617d356

  • SHA1

    07ef28c5842a5068619a6b30356e46cddbb4fda6

  • SHA256

    d182c08bed51b78f1dace83a6aa4bdb26954e7c89c9e7c8f8ae0992d6a315934

  • SHA512

    61ec6b4216dd6f9015825f71aa3f9decbde30e90a2bddac3cff5840573e36db62f7689f094c5aab196a8e52e41ec0f4e8c8b4ee20cafa80339284a72daa590b6

  • SSDEEP

    12288:VQi3dMjv6m6URA3Phdp1hf39Wkv8xwJZ3Ep:VQiWjChhdpdUMZ0p

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Extracted

Family

socelars

C2

https://hdbywe.s3.us-west-2.amazonaws.com/sfasue20/

Targets

    • Target

      file

    • Size

      756KB

    • MD5

      a9926757f1a1882142e369cc4617d356

    • SHA1

      07ef28c5842a5068619a6b30356e46cddbb4fda6

    • SHA256

      d182c08bed51b78f1dace83a6aa4bdb26954e7c89c9e7c8f8ae0992d6a315934

    • SHA512

      61ec6b4216dd6f9015825f71aa3f9decbde30e90a2bddac3cff5840573e36db62f7689f094c5aab196a8e52e41ec0f4e8c8b4ee20cafa80339284a72daa590b6

    • SSDEEP

      12288:VQi3dMjv6m6URA3Phdp1hf39Wkv8xwJZ3Ep:VQiWjChhdpdUMZ0p

    • Detects PseudoManuscrypt payload

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • PseudoManuscrypt

      PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks