Resubmissions
30-08-2024 15:35
240830-s1k4ks1fpb 330-08-2024 14:40
240830-r13g7ayhne 529-08-2024 17:21
240829-vxgyvsvbql 329-08-2024 17:21
240829-vwyj8asenc 528-08-2024 16:19
240828-tsxyvaxenn 527-08-2024 18:40
240827-xbb7laxcnk 327-08-2024 18:37
240827-w9ws8axbqk 1026-08-2024 18:21
240826-wzszksybph 326-08-2024 18:20
240826-wyv3jszbpj 326-08-2024 18:19
240826-wyka2szbmq 5General
-
Target
https://github.com/Endermanch/MalwareDatabase
-
Sample
240823-xbrmaazejc
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/Endermanch/MalwareDatabase
Resource
win10v2004-20240802-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___RSJTLD1_.txt
cerber
http://xpcx6erilkjced3j.onion/16EA-45D2-F9B4-0098-BE0E
http://xpcx6erilkjced3j.1n5mod.top/16EA-45D2-F9B4-0098-BE0E
http://xpcx6erilkjced3j.19kdeh.top/16EA-45D2-F9B4-0098-BE0E
http://xpcx6erilkjced3j.1mpsnr.top/16EA-45D2-F9B4-0098-BE0E
http://xpcx6erilkjced3j.18ey8e.top/16EA-45D2-F9B4-0098-BE0E
http://xpcx6erilkjced3j.17gcun.top/16EA-45D2-F9B4-0098-BE0E
Targets
-
-
Target
https://github.com/Endermanch/MalwareDatabase
-
Contacts a large (1113) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Discovery
Network Service Discovery
1Query Registry
2Peripheral Device Discovery
1System Information Discovery
2Browser Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Remote System Discovery
1