Resubmissions

28-11-2024 19:39

241128-yc84dstkfn 10

16-11-2024 19:52

241116-ylqcmssfqd 10

16-11-2024 17:56

241116-wjcyeszmht 10

General

  • Target

    New Text Document.exe.zip

  • Size

    1KB

  • Sample

    241116-wjcyeszmht

  • MD5

    f3910b212669210383b5efcd278818fe

  • SHA1

    1708977352c5b19d8c126797a34cd1d8eedcfd19

  • SHA256

    85b8d5214c0bc80b888c6a3404c2a371e3aaba32561d069f454b0af159015396

  • SHA512

    f6ab525df5e79d59f05ac7618de628e1e5bf956ce8db9add144214c2c8a64282a0ce79c46ca4b88c1f7754ab8cb7f0883a080e1096c9561edb1f455aff95b499

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

64.176.38.237:8139

64.176.38.237:443

Extracted

Family

vipkeylogger

Credentials

Targets

    • Target

      New Text Document.exe.zip

    • Size

      1KB

    • MD5

      f3910b212669210383b5efcd278818fe

    • SHA1

      1708977352c5b19d8c126797a34cd1d8eedcfd19

    • SHA256

      85b8d5214c0bc80b888c6a3404c2a371e3aaba32561d069f454b0af159015396

    • SHA512

      f6ab525df5e79d59f05ac7618de628e1e5bf956ce8db9add144214c2c8a64282a0ce79c46ca4b88c1f7754ab8cb7f0883a080e1096c9561edb1f455aff95b499

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

    • Netsupport family

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Downloads MZ/PE file

    • Stops running service(s)

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops startup file

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Checks for any installed AV software in registry

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Target

      New Text Document.exe

    • Size

      4KB

    • MD5

      a239a27c2169af388d4f5be6b52f272c

    • SHA1

      0feb9a0cd8c25f01d071e9b2cfc2ae7bd430318c

    • SHA256

      98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc

    • SHA512

      f30e1ff506cc4d729f7e24aa46e832938a5e21497f1f82f1b300d47f45dae7f1caef032237ef1f5ae9001195c43c0103e3ab787f9196c8397846c1dea8f351da

    • SSDEEP

      48:6r1huik0xzYGJZZJOQOulbfSqXSfbNtm:IIxcLpf6zNt

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

    • Netsupport family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks