Overview

overview

10

Static

static

3

FreePiano/...no.exe

windows11-21h2-x64

6

FreePiano/...f2.dll

windows11-21h2-x64

10

FreePiano/...p4.exe

windows11-21h2-x64

3

FreePiano/...no.dll

windows11-21h2-x64

1

QWERTY/Mid...ty.exe

windows11-21h2-x64

1

QWERTY/SDL2.dll

windows11-21h2-x64

1

QWERTY/portmidi.dll

windows11-21h2-x64

1

setuploopbe1.exe

windows11-21h2-x64

7

$PLUGINSDI...PI.dll

windows11-21h2-x64

1

$PLUGINSDI...ns.dll

windows11-21h2-x64

8

$PLUGINSDI...nu.dll

windows11-21h2-x64

5

$PLUGINSDI...em.dll

windows11-21h2-x64

$PLUGINSDI...fo.dll

windows11-21h2-x64

$PLUGINSDI...st.exe

windows11-21h2-x64

1

$PLUGINSDI...e1.sys

windows11-21h2-x64

1

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    JfPvxHzKLqqy.zip
  • Size 4.9MB
  • Sample240811-eppqqsyckg
  • SHA256 5834f6ae3522131494c225a93c30173430be80b5c144519b265395c54f35172b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
modiloadernetwirenjratremcoswannacrywarzonerathostbootkitbotnetdefense_evasiondiscoveryevasionexecutionimpactinfostealermotwpersistencephishingprivilege_escalationransomwareratrezer0spywarestealertrojanworm

Malware Config

Extracted

Family

  • warzonerat

C2

  • 168.61.222.215:5400

Extracted

Family

  • modiloader

C2

  • https://drive.google.com/u/0/uc?id=1TcSctGVBajYMA7CFDc158wpvqkpxmkhJ&export=download

Extracted

Family

  • remcos

Version

  • 1.7 Pro

Botnet

  • Host

C2

  • nickman12-46565.portmap.io:46565

  • nickman12-46565.portmap.io:1735

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    Userdata.exe

  • copy_folder

    Userdata

  • delete_file

    true

  • hide_file

    true

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %WinDir%\System32

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %WinDir%\System32

  • mouse_option

    false

  • mutex

    remcos_vcexssuhap

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!Please Read Me!.txt

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

  • 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCry-main.zip\WannaCry-main\@[email protected]

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

  • 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Targets

    • Target
      FreePiano/freepiano.exe
    • Size 1.3MB
    • SHA256 f53c7cdf9fa04426f4e1100d7347d35eeb4fbd7c6795651412d229fa77ab8698
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1
    • Target
      FreePiano/plugins/plugin_sf2.dll
    • Size 329KB
    • SHA256 d0b80fbf7ebc9e392813beaf518d856204338e7127dc98c80b8e0396b9fea09f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    wannacrydefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

      defense_evasion

    • Legitimate hosting services abused for malware hosting/C2

    • Sets desktop wallpaper using registry

      ransomware
    behavioral2
    • Target
      FreePiano/plugins/plugin_xfmp4.exe
    • Size 1.7MB
    • SHA256 3b2dbd1e356d3a32914f5db00a2dc10d697f90568adfd17d739ebcceeabe1c8d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral3
    • Target
      FreePiano/vsti/mdaPiano.dll
    • Size 1.2MB
    • SHA256 0be2c93d003df789c7c403d1600b226b0903b4f7cee65322de4e4416aaf9dc22
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral4
    • Target
      QWERTY/Midi to Qwerty.exe
    • Size 633KB
    • SHA256 fdc2e3f71edf456bfb5ff0e9d40a37455e928ba3cc47c84fbc839481ba5f5202
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5
    • Target
      QWERTY/SDL2.dll
    • Size 2.1MB
    • SHA256 74889602f25135db1489529dc0a5170f65fc756886b744aa6a414529b8abd3d9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral6
    • Target
      QWERTY/portmidi.dll
    • Size 31KB
    • SHA256 0d64c046c16d8d089f55c45d3bae20f577204783c2c8fad100bb26d897383d9b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7
    • Target
      setuploopbe1.exe
    • Size 992KB
    • SHA256 0958b39c23e02f86ba63f520cfc333842e3f7c31e197416c12f2718756ecb9be
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Loads dropped DLL

    behavioral8
    • Target
      $PLUGINSDIR/DIFxAPI.dll
    • Size 513KB
    • SHA256 83c43d65084cd202aa9982af6d87c963a05035f1e2cdac48304fa299584e3242
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral9
    • Target
      $PLUGINSDIR/InstallOptions.dll
    • Size 14KB
    • SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    bootkitdiscoveryevasionpersistence

    • Disables Task Manager via registry modification

      evasion

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral10
    • Target
      $PLUGINSDIR/StartMenu.dll
    • Size 7KB
    • SHA256 e4a54bfc327986a89165bdef361069810aaa985c3abecd442c786725fabaf977
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discovery

    • Drops file in System32 directory

    behavioral11
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    modiloadernetwirenjratremcoswannacrywarzonerathostbotnetdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistenceprivilege_escalationransomwareratrezer0stealertrojanworm

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies WinLogon for persistence

      persistence

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • UAC bypass

      evasiontrojan

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • ModiLoader First Stage

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Warzone RAT payload

      rat

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral12
    • Target
      $PLUGINSDIR/UserInfo.dll
    • Size 4KB
    • SHA256 7d099352c82612ab27ddfd7310c1aa049b58128fb04ea6ea55816a40a6f6487b
    • MD5 SHA1 SHA512
    Score
    8/10
    discoveryevasionmotwphishingransomware

    • Disables Task Manager via registry modification

      evasion

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Mark of the Web detected: This indicates that the page was originally saved or cloned.

      phishingmotw

    • Sets desktop wallpaper using registry

      ransomware
    behavioral13
    • Target
      $PLUGINSDIR/drvinst.exe
    • Size 188KB
    • SHA256 bee3dc2cbff39c84b5a1d00535b20595b935bbcd2d8d24940def5a60a2adb7e6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral14
    • Target
      $PLUGINSDIR/loopbe1.sys
    • Size 13KB
    • SHA256 d2c20282d6e5dbff38c00df745f19f2457baf53cb5ee30c02979029fa04e0ddb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 6KB
    • SHA256 ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

2
T1546

Image File Execution Options Injection

1
T1546.012

Netsh Helper DLL

1
T1546.007

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

2
T1546

Image File Execution Options Injection

1
T1546.012

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Direct Volume Access

1
T1006

File and Directory Permissions Modification

2
T1222

Windows File and Directory Permissions Modification

1
T1222.001

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

4
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

2
T1562.001

Safe Mode Boot

1
T1562.009

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

6
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

Remote System Discovery

1
T1018

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

3
T1490

Tasks