General
-
Target
29e4286da3c9c41f164126d348280460_NEAS
-
Size
1.8MB
-
Sample
240507-lmmxpadd43
-
MD5
29e4286da3c9c41f164126d348280460
-
SHA1
498e29d89f36b8436588d03be375df25b0e3d3ff
-
SHA256
c1b2d2c9801a910452041d08a973b4d9c635df580d807e97892439bb856a2439
-
SHA512
5b921049fd784cb5248c6c2ad80046deba4a04418b6e18d1e5d528e1925a383f63f52c8e33a0b061371b7f5f31539882124ae36762d2a1e2dad1465f41102d0c
-
SSDEEP
49152:8VAu56C9kLTyfm9pfDBlNkRSAIlNcYOtr:8VBk6fqfNlNGSAIlNE
Static task
static1
Malware Config
Extracted
amadey
4.18
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Extracted
redline
Test1234
185.215.113.67:26260
Extracted
stealc
http://52.143.157.84
-
url_path
/c73eed764cc59dcb.php
Extracted
amadey
4.18
http://193.233.132.56
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Targets
-
-
Target
29e4286da3c9c41f164126d348280460_NEAS
-
Size
1.8MB
-
MD5
29e4286da3c9c41f164126d348280460
-
SHA1
498e29d89f36b8436588d03be375df25b0e3d3ff
-
SHA256
c1b2d2c9801a910452041d08a973b4d9c635df580d807e97892439bb856a2439
-
SHA512
5b921049fd784cb5248c6c2ad80046deba4a04418b6e18d1e5d528e1925a383f63f52c8e33a0b061371b7f5f31539882124ae36762d2a1e2dad1465f41102d0c
-
SSDEEP
49152:8VAu56C9kLTyfm9pfDBlNkRSAIlNcYOtr:8VBk6fqfNlNGSAIlNE
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detect ZGRat V1
-
Glupteba payload
-
Modifies firewall policy service
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Modifies boot configuration data using bcdedit
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Modifies Installed Components in the registry
-
Modifies Windows Firewall
-
Possible attempt to disable PatchGuard
Rootkits can use kernel patching to embed themselves in an operating system.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
3PowerShell
2Scheduled Task/Job
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
6Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
8Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1