Extracted

Extracted

• • Target
    Malware.zip
  • Size 5KB
  • SHA256 c5d4716e5b7386aedce0ca86a3c1986f50f2cd0ff22bec5da599ff66459e3f2d
  • MD5 7b03303e221c0ab68f2fd75c88af2666
  • SHA1 919e98ee4534158b97c1a20e5fb99758c714bbca
  • SHA512 a4a10a6bf73ae9d502b65c085b7b9fde4014df5b55e1b99e3275942231773ae12d96fd63afc6c89b5cfe8de5321485d3dbd52e7a865163e9bdd5bd781256cd8f
  • SSDEEP 96:ZotQ49ksSuzU4oVc1C6rmanB6Ykghby6IzN4cxG3bzDFI4NO:Zo6ekX2U4x1FrZ6Ykgh2vz83b9NO
  • TLSH
    T1E6B18EECFDBE699BC9A997761C253918505AF7E500BA715D001DEB53E8AB329CB03C04
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  dragon_breathaptfirstdefense_evasiondiscoveryexecutionexploitmimikatzredlineroningloaderstealeriumimpactinfostealerinstallerloaderpersistenceprivilege_escalationpyinstallerransomwarerevoked_codesignspywarestealerthemidatrojan

  • Detects RoningLoader loader

    loaderaptdragon_breath

  • Family: Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: RoningLoader

    RoningLoader is a multi-stage malware loader used by the Dragon Breath APT.

    loaderroningloader

  • Family: Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Modifies WinLogon for persistence

    persistence

  • RedLine payload

  • UAC bypass

    defense_evasiontrojan

  • mimikatz is an open source tool to dump credentials on Windows

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Deletes system backups

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Possible privilege escalation attempt

    exploit

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1