Overview

overview

10

Static

static

10

1214e5f9de...98.exe

windows7-x64

6

1214e5f9de...98.exe

windows10-2004-x64

7

236020bb91...f6.exe

windows7-x64

10

236020bb91...f6.exe

windows10-2004-x64

10

25dc70a3de...60.exe

windows7-x64

10

25dc70a3de...60.exe

windows10-2004-x64

10

54de718b63...d9.exe

windows7-x64

1

54de718b63...d9.exe

windows10-2004-x64

3

7ae9504811...a4.exe

windows7-x64

10

7ae9504811...a4.exe

windows10-2004-x64

10

9c2554e79b...a0.exe

windows7-x64

10

9c2554e79b...a0.exe

windows10-2004-x64

10

a568f22004...3b.exe

windows7-x64

10

a568f22004...3b.exe

windows10-2004-x64

8

aefd0c7794...37.exe

windows7-x64

10

aefd0c7794...37.exe

windows10-2004-x64

10

d68b4d6cec...27.exe

windows7-x64

10

d68b4d6cec...27.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4a8e933462209a204f87c02e41e88e99541ccb85964a22d9762f443cf19af409
  • Size 20.8MB
  • Sample241108-cma4fsshmf
  • SHA256 4a8e933462209a204f87c02e41e88e99541ccb85964a22d9762f443cf19af409
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
asyncratgluptebametasploitnjratredlinesectoprat@fanat_022@seno_47nullsergeytestbackdoordiscoverydropperevasionexecutioninfostealerloaderpersistenceprivilege_escalationratrootkitspywarestealertrojan

Malware Config

Extracted

Family

  • asyncrat

Version

  • 0.5.6A

Botnet

  • null

C2

  • 95.169.210.148:6666

Mutex

  • bavaulifmjawicwh

Attributes
  • delay

    5

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

  • metasploit

Version

  • windows/single_exec

Extracted

Family

  • redline

Botnet

  • Sergey

C2

  • 185.203.243.131:27365

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • test

C2

  • hakim32.ddns.net:2000

  • 2.tcp.ngrok.io:17971

Mutex

  • 7510b18d6d0540b453f74c07e4a22b0c

Attributes
  • reg_key

    7510b18d6d0540b453f74c07e4a22b0c

  • splitter

    |'|'|

Extracted

Family

  • redline

Botnet

  • @Seno_47

C2

  • 45.81.227.32:22625

Extracted

Family

  • redline

Botnet

  • @Fanat_022

C2

  • 152.228.150.198:11188

Targets

    • Target
      1214e5f9dec9e4c94ccf93c4495788c8314f396ce74dbb5c15cd372411ceed98
    • Size 1.0MB
    • SHA256 1214e5f9dec9e4c94ccf93c4495788c8314f396ce74dbb5c15cd372411ceed98
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoveryspywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2
    • Target
      236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6
    • Size 541KB
    • SHA256 236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    redlinesectoprat@seno_47discoveryinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Sectoprat family

      sectoprat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral3behavioral4
    • Target
      25dc70a3def65cca61f30ad3a818edbf0dcebbf8257a302212fd7424cc7e8560
    • Size 405KB
    • SHA256 25dc70a3def65cca61f30ad3a818edbf0dcebbf8257a302212fd7424cc7e8560
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    redlinesectoprat@fanat_022discoveryinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Sectoprat family

      sectoprat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral5behavioral6
    • Target
      54de718b634d2dbddaf2530aa3b1768823dfdd97f5a2782b4131fe369e903dd9
    • Size 15.7MB
    • SHA256 54de718b634d2dbddaf2530aa3b1768823dfdd97f5a2782b4131fe369e903dd9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      7ae95048117dcae6685b6d3206a013fc3e76631d0d4cb58a95f065d79c6cc8a4
    • Size 4.5MB
    • SHA256 7ae95048117dcae6685b6d3206a013fc3e76631d0d4cb58a95f065d79c6cc8a4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    gluptebametasploitbackdoordiscoverydropperevasionloaderpersistenceprivilege_escalationrootkittrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba family

      glupteba

    • Glupteba payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Metasploit family

      metasploit

    • Windows security bypass

      evasiontrojan

    • Modifies boot configuration data using bcdedit

    • Drops file in Drivers directory

    • Modifies Windows Firewall

      evasion

    • Possible attempt to disable PatchGuard

      Rootkits can use kernel patching to embed themselves in an operating system.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMon driver.

      Roottkits write to WinMon to hide PIDs from being detected.

      rootkitevasion

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion
    behavioral10behavioral9
    • Target
      9c2554e79b717eca531348c6e0430944ab7288bc46a8d56e2e49898c4b0e59a0
    • Size 359KB
    • SHA256 9c2554e79b717eca531348c6e0430944ab7288bc46a8d56e2e49898c4b0e59a0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    redlinesectopratsergeydiscoveryinfostealerrattrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Sectoprat family

      sectoprat

    • Suspicious use of SetThreadContext

    behavioral11behavioral12
    • Target
      a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b
    • Size 83KB
    • SHA256 a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    njrattestdiscoveryevasionpersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral13behavioral14
    • Target
      aefd0c77949ccb2192070d1fb122cad87c1fc3e3c841b1928e3763fadf286337
    • Size 206KB
    • SHA256 aefd0c77949ccb2192070d1fb122cad87c1fc3e3c841b1928e3763fadf286337
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryevasionexecutionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral15behavioral16
    • Target
      d68b4d6cec032458824abdf3ac6f379f33db2167cb0c399845f4d7735a426827
    • Size 48KB
    • SHA256 d68b4d6cec032458824abdf3ac6f379f33db2167cb0c399845f4d7735a426827
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    asyncratnullrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat
    behavioral17behavioral18

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

4
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

2
T1562.001

Modify Registry

5
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

3
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

ratnullasyncrat
Score
10/10

behavioral1

Score
6/10

behavioral2

discoveryspywarestealer
Score
7/10

behavioral3

redlinesectoprat@seno_47discoveryinfostealerrattrojan
Score
10/10

behavioral4

redlinesectoprat@seno_47discoveryinfostealerrattrojan
Score
10/10

behavioral5

redlinesectoprat@fanat_022discoveryinfostealerrattrojan
Score
10/10

behavioral6

redlinesectoprat@fanat_022discoveryinfostealerrattrojan
Score
10/10

behavioral7

Score
1/10

behavioral8

discovery
Score
3/10

behavioral9

gluptebametasploitbackdoordiscoverydropperevasionloaderpersistenceprivilege_escalationrootkittrojan
Score
10/10

behavioral10

gluptebametasploitbackdoordiscoverydropperevasionloaderpersistenceprivilege_escalationrootkittrojan
Score
10/10

behavioral11

redlinesectopratsergeydiscoveryinfostealerrattrojan
Score
10/10

behavioral12

redlinesectopratsergeydiscoveryinfostealerrattrojan
Score
10/10

behavioral13

njrattestdiscoveryevasionpersistenceprivilege_escalationtrojan
Score
10/10

behavioral14

discoveryevasionpersistenceprivilege_escalation
Score
8/10

behavioral15

discoveryevasionexecutionpersistence
Score
10/10

behavioral16

discoveryevasionexecutionpersistence
Score
10/10

behavioral17

asyncratnullrat
Score
10/10

behavioral18

asyncratnullrat
Score
10/10