Overview

overview

10

Static

static

10

Telegram.exe

windows10-2004-x64

10

Yandex.exe

windows10-2004-x64

10

lolz.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Downloads.zip

  • Size

    5.1MB

  • Sample

    250216-sc2fnazren

  • MD5

    29e95b12774dc1afe1335daa136b3756

  • SHA1

    2120cc236f531c216e0b38f1e1b7fb04e5e0b477

  • SHA256

    1c4c4bf1fbd42875bd7b40225812c008359a4ae648e29f47b0dbcf1d609c6303

  • SHA512

    3c9fd3eef4786dee4ed6d4df5d844ad688ad13dcb18eefee87996098d224163135204845cee4808bced22195a31565c1028cc320c7df954a3d93b465fe8a9da7

  • SSDEEP

    98304:G5KgfAGzkb7L/zYu7dYCqaTH9ddnSpDpa2QxjapKEyvpTVry:YKNGzkbEuKCNDdSNZkVry

Score
10/10
dcratstormkittyxmrigdefense_evasiondiscoveryexecutioninfostealerminerpersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      Telegram.exe

    • Size

      1.5MB

    • MD5

      cbc1250f5968b3aad9f7b917ab0cb3fa

    • SHA1

      57b64deea04bc339894d77725703c4d0b239f47e

    • SHA256

      65b40c1d42b7b6248defa42191a2ac60c239f8f72889a6544e7427ab3c7c0587

    • SHA512

      cf5eabff6cdcff3a314d3e884028ad908ab866934af520623e97f7ed9b58834e7c34f3b371288461c627eb7921e8e94a29e0390151134efd46263d3fb3b3cc93

    • SSDEEP

      24576:U2G/nvxW3Ww0twsabRr96PUyifNzW657ZcGUOXTjieEVFpZ9867SgxeU1nS9x8Ay:UbA30+R0U5xgOFsbP7Bxe0S74yw

    Score
    10/10
    dcratdefense_evasiondiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

    • Target

      Yandex.exe

    • Size

      339KB

    • MD5

      2404b4b110e2f3b8ce146dc848d72f2c

    • SHA1

      6882535245001c0e00e9ff483cab7bfeb1043c6f

    • SHA256

      d6778a29b917e503e4ee88120b289fba2b6faec182fa5094907f2ca66bb6b142

    • SHA512

      ee379f16ccd5fa8bc7a319f5398d8ad7db38ea95e63f1b2ffd74becbf83fc4c7df67f8064d7fb5578a60b0dc4b886d4d1dd282976f9ef462a1d3f34192e01a3a

    • SSDEEP

      3072:Fm+FrFLPdIuW/cRdyYZ2r1J0ZNk5TP8VveGX5If5V8KBA2Rtml6cBLV4adiQLeIh:I+FrFPWv/eFZNk5L8V/iBV8yIRR4sO5q

    Score
    10/10
    stormkittyspywarestealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware
    behavioral2

    • Target

      lolz.exe

    • Size

      5.0MB

    • MD5

      c814bb1eb11d8e69b2b13982d658d79c

    • SHA1

      8ee6766f76a243b8b32107a97930020a7a8eef50

    • SHA256

      b4f0d77f5688afdcbd0e8ee79dbd30a734280878cc4ffe1fac1f3cdebc4c5605

    • SHA512

      ae2d10e498589f42530995c4cffda917239a8a216468ff264cb0fe8de703e51f78612053d5c86521e0e30863c1ccd36322587b9828ee8f0679dbb7c2bad0628c

    • SSDEEP

      98304:zdPupPUwdawGgC3D+euvqKYzbupsOismK03mUHzcvO8xwahthJsq:zZwdawGPDf8Ebuxo9wvrzhJsq

    Score
    10/10
    xmrigdefense_evasiondiscoveryexecutionminerpersistenceupx

    • Xmrig family

      xmrig

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Creates new service(s)

      persistenceexecution

    • Stops running service(s)

      defense_evasionexecution

    • Executes dropped EXE

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

System Services

2
T1569

Service Execution

2
T1569.002

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Power Settings

1
T1653

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

1
T1562

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Tasks