General

  • Target

    5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60

  • Size

    1MB

  • Sample

    231129-q4xknsgf81

  • MD5

    28ab830a811cb185ddd75568a8eaf994

  • SHA1

    50d73300959e82e6e8f4020d8e6d96d6c8a4cce9

  • SHA256

    5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60

  • SHA512

    0e260edcd7a800fe8e3de66611d80488211ac4d498326de4952758ee54f488036c464cdc31d49323553bf4ba8a777c09caeab4f7459287552ec33f0c68492f04

  • SSDEEP

    24576:yywDUfQUYIhFI9yxWw2C54Ty3B9/lYxwQVCDWSIck8i8j7nSlXiiWT7IzK6neLNb:ZwDyOK8ePPx9/lYxYe8DQXT40+iqL+E

Malware Config

Extracted

Family

risepro

C2

194.49.94.152

Extracted

Family

redline

Botnet

horda

C2

194.49.94.152:19053

Extracted

Family

smokeloader

Version

2022

C2

http://194.49.94.210/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@ytlogsbot

C2

194.169.175.235:42691

Extracted

Family

redline

Botnet

LiveTraffic

C2

195.10.205.16:2245

Targets

    • Target

      5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60

    • Size

      1MB

    • MD5

      28ab830a811cb185ddd75568a8eaf994

    • SHA1

      50d73300959e82e6e8f4020d8e6d96d6c8a4cce9

    • SHA256

      5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60

    • SHA512

      0e260edcd7a800fe8e3de66611d80488211ac4d498326de4952758ee54f488036c464cdc31d49323553bf4ba8a777c09caeab4f7459287552ec33f0c68492f04

    • SSDEEP

      24576:yywDUfQUYIhFI9yxWw2C54Ty3B9/lYxwQVCDWSIck8i8j7nSlXiiWT7IzK6neLNb:ZwDyOK8ePPx9/lYxYe8DQXT40+iqL+E

    • Detect ZGRat V1

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Modifies Windows Firewall

    • Stops running service(s)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Detected potential entity reuse from brand paypal.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Impair Defenses

1
T1562

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

5
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Impact

Service Stop

1
T1489

Tasks