Overview

overview

10

Static

static

10

94620a7635...c7.exe

windows7-x64

10

94620a7635...c7.exe

windows10-2004-x64

10

Discordrat.exe

windows7-x64

10

Discordrat.exe

windows10-2004-x64

10

F4620C0AFA...F5.exe

windows7-x64

10

F4620C0AFA...F5.exe

windows10-2004-x64

10

a2bc9b467f...23.exe

windows7-x64

10

a2bc9b467f...23.exe

windows10-2004-x64

10

unturnedHack.exe

windows7-x64

10

unturnedHack.exe

windows10-2004-x64

10

Resubmissions

24/11/2024, 19:42

241124-yexs5s1rgq10

24/11/2024, 09:24

241124-lc6xtatmay10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Testing5.zip
  • Size 6.0MB
  • Sample241124-lc6xtatmay
  • SHA256 2c41808826974a0fdd3c7b27850143cad077a79e0cf69c011da495d6abee679a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeycryptbotdcratdiscordratmeduzastealc4bee079c9aa5marscollectioncredential_accessdiscoveryevasionexecutioninfostealerpersistenceransomwareratrootkitspywarestealertrojan

Malware Config

Extracted

Family

  • discordrat

Attributes
  • discord_token

    MTMwOTg3NTA0MzA1MTg5Njk1NA.GTR-3U.C7tazMXoRaSR--tVDMbQdoDKBw2f8bLXItZIRo

  • server_id

    1309876526615101530

Extracted

Family

  • amadey

Version

  • 5.04

Botnet

  • 4bee07

C2

  • http://185.215.113.209

Attributes
  • install_dir

    fc9e0aaab7

  • install_file

    defnur.exe

  • strings_key

    191655f008adc880f91bfc85bc56db54

  • url_paths

    /Fru7Nk9/index.php

rc4.plain

Extracted

Family

  • amadey

Version

  • 4.42

Botnet

  • 9c9aa5

C2

  • http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

  • stealc

Botnet

  • mars

C2

  • http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

  • meduza

C2

  • 109.107.181.162

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    761

  • extensions

    none

  • grabber_max_size

    1.048576e+06

  • links

    none

  • port

    15666

  • self_destruct

    true

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\K18zGoDMql.README.txt

Ransom Note
  • ATTENTION! Don’t worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that’s price for you is $490. Please note that you’ll never restore your data without payment. To get this software and key you need join our server discord: discord.gg/ Personal ID: 71714dab686b45fc9552bf93b31d8588

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\GK9X59JWEe.README.txt

Ransom Note
  • ATTENTION! Don’t worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that’s price for you is $490. Please note that you’ll never restore your data without payment. To get this software and key you need join our server discord: discord.gg/ Personal ID: 2db500aa20c44aaf8a31681e8bab5dd0

Targets

    • Target
      94620a76353f019700029a53664a5b388bb67e49dfb4512ef688a733552f0fc7.exe
    • Size 1.8MB
    • SHA256 94620a76353f019700029a53664a5b388bb67e49dfb4512ef688a733552f0fc7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    amadeycryptbotstealc4bee079c9aa5marscredential_accessdiscoveryevasionpersistencespywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Amadey family

      amadey

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • Cryptbot family

      cryptbot

    • Detects CryptBot payload

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Stealc family

      stealc

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2
    • Target
      Discordrat.exe
    • Size 90KB
    • SHA256 1f3b8599d811004b6d52d543e451555944c3c4dc2893d04a370a0874e99c82af
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discordratpersistenceratrootkitstealer
    behavioral3behavioral4
    • Target
      F4620C0AFA8E21897509B2E7215097F5.exe
    • Size 2.1MB
    • SHA256 8daf7dcdf256d7de40d33e5550dc5e8bbf887b8c4b7f49c79a15c96dad867f82
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    dcratdiscoveryinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral5behavioral6
    • Target
      a2bc9b467f331a26b33cfd70f7bf12c9e2e6b3ebc8d3749c12a7eedf507e9323.exe
    • Size 254KB
    • SHA256 a2bc9b467f331a26b33cfd70f7bf12c9e2e6b3ebc8d3749c12a7eedf507e9323
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    credential_accessdiscoveryexecutionransomwarespywarestealer

    • Renames multiple (391) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral7behavioral8
    • Target
      unturnedHack.exe
    • Size 4.1MB
    • SHA256 4531a1efd815df17d3a6f247d0850ab5e510de2345723e41c062716e65df686e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    meduzacollectiondiscoveryspywarestealer

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

      stealermeduza

    • Meduza Stealer payload

    • Meduza family

      meduza

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral10behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Modify Authentication Process

1
T1556

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Authentication Process

1
T1556

Modify Registry

4
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Modify Authentication Process

1
T1556

Steal Web Session Cookie

1
T1539

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

8
T1012

Remote System Discovery

1
T1018

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Virtualization/Sandbox Evasion

2
T1497

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

discordrat
Score
10/10

behavioral1

amadeycryptbotstealc4bee079c9aa5marscredential_accessdiscoveryevasionpersistencespywarestealertrojan
Score
10/10

behavioral2

amadeycryptbotstealc4bee079c9aa5marscredential_accessdiscoveryevasionpersistencespywarestealertrojan
Score
10/10

behavioral3

discordratpersistenceratrootkitstealer
Score
10/10

behavioral4

discordratpersistenceratrootkitstealer
Score
10/10

behavioral5

dcratdiscoveryinfostealerratspywarestealer
Score
10/10

behavioral6

dcratdiscoveryinfostealerratspywarestealer
Score
10/10

behavioral7

credential_accessdiscoveryexecutionransomwarespywarestealer
Score
10/10

behavioral8

credential_accessdiscoveryexecutionransomwarespywarestealer
Score
10/10

behavioral9

meduzacollectiondiscoveryspywarestealer
Score
10/10

behavioral10

meduzacollectiondiscoveryspywarestealer
Score
10/10