Resubmissions

15-06-2023 09:57

230615-lzef3sfg7z 7

28-02-2023 09:08

230228-k3wzvsac8y 10

General

  • Target

    file.exe

  • Size

    380KB

  • Sample

    230228-k3wzvsac8y

  • MD5

    bbd74fe84f0cd1c6a490d33ccd2d5588

  • SHA1

    7232328b8e24ec0d5ce5e29ad446a5150534b771

  • SHA256

    d6c7416582172b48537000e0f604ad4836c2298130ce61ee64187d2e5659bdf7

  • SHA512

    0402625cdd798cb36eaf4c3772921c5e372a21f7b7234a2811a64275ac6acc63ec1245d4270346a316a542d6f18223959f1b66ee96d053ec8259572263bd13b6

  • SSDEEP

    6144:K/QiQXCA6m+ksmpk3U9jW1U4P9bBiQtCsZ/+/imJIGh7bc92xa+5o1WUK0h06PYA:yQi3Ap6m6URA3PhBtthtE/E9y5uVPYgV

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Extracted

Family

socelars

C2

https://hdbywe.s3.us-west-2.amazonaws.com/sfasue20/

Targets

    • Target

      file.exe

    • Size

      380KB

    • MD5

      bbd74fe84f0cd1c6a490d33ccd2d5588

    • SHA1

      7232328b8e24ec0d5ce5e29ad446a5150534b771

    • SHA256

      d6c7416582172b48537000e0f604ad4836c2298130ce61ee64187d2e5659bdf7

    • SHA512

      0402625cdd798cb36eaf4c3772921c5e372a21f7b7234a2811a64275ac6acc63ec1245d4270346a316a542d6f18223959f1b66ee96d053ec8259572263bd13b6

    • SSDEEP

      6144:K/QiQXCA6m+ksmpk3U9jW1U4P9bBiQtCsZ/+/imJIGh7bc92xa+5o1WUK0h06PYA:yQi3Ap6m6URA3PhBtthtE/E9y5uVPYgV

    • Detects PseudoManuscrypt payload

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • PseudoManuscrypt

      PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Software Discovery

1
T1518

Query Registry

3
T1012

System Information Discovery

4
T1082

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks