General

  • Target

    Dispam.exe

  • Size

    12.1MB

  • Sample

    240919-rllk5asflf

  • MD5

    a89b5a734cced64ae3cc202bdfac8759

  • SHA1

    81a4254491dd554a5113f63ad7849d93cc30d3d7

  • SHA256

    fd111c335073ae9b9f33d1f3e348bcbc46dd0b90de333156c2dbbee62412374b

  • SHA512

    68ac8b1e4739fb444f1ef055015455094a3c768c84e96279996a11a9e1a4e7ae2192acb862cd896844c01cbed24e3fc0868fa8891d4806a46e70e2e3e2175e73

  • SSDEEP

    393216:0GV2CSQhZ2YsHFUK2Jn1+TtIiFQS2NXNsI8VbTToP:TYQZ2YwUlJn1QtIm28IKzo

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Extracted

Family

emotet

Botnet

Epoch3

C2

109.206.139.119:80

45.177.120.36:80

162.241.41.111:7080

190.85.46.52:7080

41.212.89.128:80

185.208.226.142:8080

185.142.236.163:443

111.89.241.139:80

138.201.45.2:8080

103.80.51.61:8080

162.144.42.60:8080

180.148.4.130:8080

115.78.11.155:80

86.57.216.23:80

91.75.75.46:80

153.229.219.1:443

167.71.227.113:8080

88.247.58.26:80

195.201.56.70:8080

14.241.182.160:80

rsa_pubkey.plain

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      Dispam.exe

    • Size

      12.1MB

    • MD5

      a89b5a734cced64ae3cc202bdfac8759

    • SHA1

      81a4254491dd554a5113f63ad7849d93cc30d3d7

    • SHA256

      fd111c335073ae9b9f33d1f3e348bcbc46dd0b90de333156c2dbbee62412374b

    • SHA512

      68ac8b1e4739fb444f1ef055015455094a3c768c84e96279996a11a9e1a4e7ae2192acb862cd896844c01cbed24e3fc0868fa8891d4806a46e70e2e3e2175e73

    • SSDEEP

      393216:0GV2CSQhZ2YsHFUK2Jn1+TtIiFQS2NXNsI8VbTToP:TYQZ2YwUlJn1QtIm28IKzo

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Cobalt Strike reflective loader

      Detects the reflective loader used by Cobalt Strike.

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

    • Detect Blackmoon payload

    • Detect Neshta payload

    • Detect Xworm Payload

    • Detects MyDoom family

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • MyDoom

      MyDoom is a Worm that is written in C++.

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Xworm

      Xworm is a remote access trojan written in C#.

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Emotet payload

      Detects Emotet payload in memory.

    • ModiLoader Second Stage

    • XMRig Miner payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks