Overview

overview

10

Static

static

10

241105-dtx...ed.zip

windows7-x64

1

241105-dtx...ed.zip

windows10-2004-x64

10

201106-9sx...ed.zip

windows7-x64

1

201106-9sx...ed.zip

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target
    241105-dtxrgatbpg_pw_infected.zip
  • Size 132.7MB
  • Sample241111-dlmlja1jbx
  • SHA256 38bc13ef112b2f17d4d1a80243fac6a521b5d58228984aae0752d79487fa3b66
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
burancobaltstrikemodiloadernjratrevengeratsmokeloaderxredzeppelinzloader07/0409/0425/03305419896guesthackhackedinsert-coinmainsamaysystemtenaktvictimexdsdddyt26.02.2020backdoorcryptonedefense_evasiondiscoveryevasionexecutionimpactpackerpersistenceransomwarestealertrojanupx

Malware Config

Extracted

Family

  • zloader

Botnet

  • main

Campaign

  • 26.02.2020

C2

  • https://airnaa.org/sound.php

  • https://banog.org/sound.php

  • https://rayonch.org/sound.php

Attributes
  • build_id

    19

rc4.plain

Extracted

Family

  • revengerat

Botnet

  • XDSDDD

C2

  • 84.91.119.105:333

Mutex

  • RV_MUTEX-wtZlNApdygPh

Extracted

Family

  • revengerat

Botnet

  • Victime

C2

  • cocohack.dtdns.net:84

Mutex

  • RV_MUTEX-OKuSAtYBxGgZHx

Extracted

Family

  • zloader

Botnet

  • 25/03

C2

  • https://wgyvjbse.pw/milagrecf.php

  • https://botiq.xyz/milagrecf.php

Attributes
  • build_id

    103

rc4.plain

Extracted

Family

  • revengerat

Botnet

  • samay

C2

  • shnf-47787.portmap.io:47787

Mutex

  • RV_MUTEX

Extracted

Family

  • zloader

Botnet

  • 09/04

C2

  • https://eoieowo.casa/wp-config.php

  • https://dcgljuzrb.pw/wp-config.php

Attributes
  • build_id

    140

rc4.plain

Extracted

Family

  • zloader

Botnet

  • 07/04

C2

  • https://xyajbocpggsr.site/wp-config.php

  • https://ooygvpxrb.pw/wp-config.php

Attributes
  • build_id

    131

rc4.plain

Extracted

Family

  • cobaltstrike

Botnet

  • 305419896

C2

  • http://47.91.237.42:8443/__utm.gif

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    47.91.237.42,/__utm.gif

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • polling_time

    60000

  • port_number

    8443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDS7zRQv7EhhTkbgDrCNBsNay7lzQFmcC/GWwjOq93nKwPSszjIKgtW8nwhtoRhr6MFZx4DSYFdeuJDrtJNcTZz2C/LgZzhSQJmhiEqCkVqPPCfK1C6S4PzDrzy9L794rPLOuoewlGAXgiH5/Ae2aC5k2wedRNfes3DJZDDCaJJYwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0)

  • watermark

    305419896

Extracted

Family

  • revengerat

Botnet

  • INSERT-COIN

C2

  • 3.tcp.ngrok.io:24041

Mutex

  • RV_MUTEX

Extracted

Family

  • revengerat

Botnet

  • YT

C2

  • yukselofficial.duckdns.org:5552

Mutex

  • RV_MUTEX-WlgZblRvZwfRtNH

Extracted

Family

  • revengerat

Botnet

  • system

C2

  • yj233.e1.luyouxia.net:20645

Mutex

  • RV_MUTEX-GeVqDyMpzZJHO

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • HacKed

C2

  • srpmx.ddns.net:5552

Mutex

  • c6c84eeabbf10b049aa4efdb90558a88

Attributes
  • reg_key

    c6c84eeabbf10b049aa4efdb90558a88

  • splitter

    |'|'|

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • HACK

C2

  • 43.229.151.64:5552

Mutex

  • 6825da1e045502b22d4b02d4028214ab

Attributes
  • reg_key

    6825da1e045502b22d4b02d4028214ab

  • splitter

    Y262SUCZ4UJJ

Extracted

Family

  • revengerat

Botnet

  • Guest

C2

  • 178.17.174.71:3310

Mutex

  • RV_MUTEX-HxdYuaWVCGnhp

Extracted

Family

  • revengerat

Botnet

  • tenakt

C2

  • 94.23.220.50:559

Mutex

  • RV_MUTEX-YtjWSTUKIWwi

Targets

    • Target
      241105-dtxrgatbpg_pw_infected.zip
    • Size 132.7MB
    • SHA256 38bc13ef112b2f17d4d1a80243fac6a521b5d58228984aae0752d79487fa3b66
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    smokeloaderbackdoordiscoveryexecutiontrojan
    behavioral1behavioral2
    • Target
      201106-9sxjh7tvxj_pw_infected.zip
    • Size 162KB
    • SHA256 b99f3781093d168fe884a5e9578589628d9df871f08aedc6cacddfb223339cb2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    buranrevengeratzeppelinguesttenaktdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan

    • Buran

      Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

      ransomwareburan

    • Buran family

      buran

    • Detects Zeppelin payload

    • Modifies WinLogon for persistence

      persistence

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Revengerat family

      revengerat

    • UAC bypass

      evasiontrojan

    • Zeppelin Ransomware

      Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

      ransomwarezeppelin

    • Zeppelin family

      zeppelin

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (6077) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Disables RegEdit via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

JavaScript

1
T1059.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

4
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

1
T1490

Tasks