Resubmissions

01-10-2023 16:43

231001-t8rf1aca6v 10

01-10-2023 16:29

231001-ty8yasde48 10

General

  • Target

    Desktop.7z

  • Size

    40MB

  • Sample

    231001-ty8yasde48

  • MD5

    de689d7172570975e45c8de861703d9a

  • SHA1

    ca93484119dab6a2058dfd4c8394c1e4dc328e6f

  • SHA256

    8324822dead804bf3ea27145f2ad10bf55d839ec8cd914d48160674c8cb50445

  • SHA512

    6fdbcd62e70ee4cf6a066697ce224da349993a97b8e913bbb6a1e47b2c8b91a786a134d3fd023671b919d78436cbfa53ac3ba93cdb424988546c9ec30455e6bd

  • SSDEEP

    786432:q+3daapFvXlfdw7y6+SdIapVSNtx/vb26n9GYoQ4Ri4yYqJS8ynd4NMn:Po49leytCVS1nbpLpNSddjn

Malware Config

Targets

    • Target

      Desktop.7z

    • Size

      40MB

    • MD5

      de689d7172570975e45c8de861703d9a

    • SHA1

      ca93484119dab6a2058dfd4c8394c1e4dc328e6f

    • SHA256

      8324822dead804bf3ea27145f2ad10bf55d839ec8cd914d48160674c8cb50445

    • SHA512

      6fdbcd62e70ee4cf6a066697ce224da349993a97b8e913bbb6a1e47b2c8b91a786a134d3fd023671b919d78436cbfa53ac3ba93cdb424988546c9ec30455e6bd

    • SSDEEP

      786432:q+3daapFvXlfdw7y6+SdIapVSNtx/vb26n9GYoQ4Ri4yYqJS8ynd4NMn:Po49leytCVS1nbpLpNSddjn

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

    • Detect Xworm Payload

    • Modifies firewall policy service

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Bazar/Team9 Loader payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Registers COM server for autorun

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Legitimate hosting services abused for malware hosting/C2

    • Detected potential entity reuse from brand google.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Browser Extensions

1
T1176

Scheduled Task/Job

1
T1053

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

8
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

6
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

2
T1120

Remote System Discovery

1
T1018

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks