Resubmissions
09-09-2020 09:18
200909-ev13telmdn 1008-09-2020 17:08
200908-br2a8ynnpn 1008-09-2020 17:07
200908-2bbw72ekmn 1008-09-2020 16:54
200908-qgbye23mhs 1008-09-2020 16:46
200908-p5f4c5cdzj 10Analysis
-
max time kernel
151s -
max time network
133s -
platform
windows7_x64 -
resource
win7 -
submitted
08-09-2020 17:08
Static task
static1
Behavioral task
behavioral1
Sample
23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe
Resource
win7
Behavioral task
behavioral2
Sample
23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe
Resource
win10v200722
General
-
Target
23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe
-
Size
154KB
-
MD5
91879bdd73625ac38c31fe5225310e92
-
SHA1
a007b979483ee6b57b93a11340932a60f5781570
-
SHA256
23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b
-
SHA512
22678f18385ed177ed34cac52fc8667c6d6cdc2953b1818a6e530411894aa6947b04408320137af8ebd5b1d6d733f374a1d962608e0e6c234e5a43b89fe9de3c
Malware Config
Extracted
C:\Users\Admin\AppData\LocalLow\machineinfo.txt
raccoon
Extracted
smokeloader
2020
http://dkajsdjiqwdwnfj.info/
http://2831ujedkdajsdj.info/
http://928eijdksasnfss.info/
https://dkajsdjiqwdwnfj.info/
https://2831ujedkdajsdj.info/
https://928eijdksasnfss.info/
Extracted
zloader
DLLobnova
02.09.2020
https://fsakfkdsajdajskjajs.online/gate.php
https://fdsadjsadsdsa.online/gate.php
https://dlsafoslfskfsafad.online/gate.php
https://dsofkasfsakdsdsa.online/gate.php
https://dkjsjdsjdjasduiasida.online/gate.php
https://fqnvtmqsywublocpheas.ru/gate.php
https://fqnvtmqsywublocpheas.su/gate.php
https://fqnvtmqsywublocpheas.eu/gate.php
https://fqnvtmqsywublocpheas.net/gate.php
https://fqnvtmqsywublodscpheas.com/gate.php
Signatures
-
Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.
Processes:
yara_rule raccoon_log_file -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
Processes:
BA2C.exepid process 1908 BA2C.exe -
Deletes itself 1 IoCs
Processes:
pid process 1312 -
Loads dropped DLL 10 IoCs
Processes:
23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exeregsvr32.exeBA2C.exepid process 1080 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe 1872 regsvr32.exe 1908 BA2C.exe 1908 BA2C.exe 1908 BA2C.exe 1908 BA2C.exe 1908 BA2C.exe 1908 BA2C.exe 1908 BA2C.exe 1908 BA2C.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
JavaScript code in executable 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll js -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1068 timeout.exe -
Processes:
BA2C.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 BA2C.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 BA2C.exe -
Suspicious behavior: EnumeratesProcesses 770 IoCs
Processes:
23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exepid process 1080 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe 1080 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exepid process 1080 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
pid process 1312 1312 1312 1312 -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
pid process 1312 1312 1312 1312 -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
regsvr32.exeBA2C.execmd.exedescription pid process target process PID 1312 wrote to memory of 1624 1312 regsvr32.exe PID 1312 wrote to memory of 1624 1312 regsvr32.exe PID 1312 wrote to memory of 1624 1312 regsvr32.exe PID 1312 wrote to memory of 1624 1312 regsvr32.exe PID 1312 wrote to memory of 1624 1312 regsvr32.exe PID 1624 wrote to memory of 1872 1624 regsvr32.exe regsvr32.exe PID 1624 wrote to memory of 1872 1624 regsvr32.exe regsvr32.exe PID 1624 wrote to memory of 1872 1624 regsvr32.exe regsvr32.exe PID 1624 wrote to memory of 1872 1624 regsvr32.exe regsvr32.exe PID 1624 wrote to memory of 1872 1624 regsvr32.exe regsvr32.exe PID 1624 wrote to memory of 1872 1624 regsvr32.exe regsvr32.exe PID 1624 wrote to memory of 1872 1624 regsvr32.exe regsvr32.exe PID 1312 wrote to memory of 1908 1312 BA2C.exe PID 1312 wrote to memory of 1908 1312 BA2C.exe PID 1312 wrote to memory of 1908 1312 BA2C.exe PID 1312 wrote to memory of 1908 1312 BA2C.exe PID 1908 wrote to memory of 512 1908 BA2C.exe cmd.exe PID 1908 wrote to memory of 512 1908 BA2C.exe cmd.exe PID 1908 wrote to memory of 512 1908 BA2C.exe cmd.exe PID 1908 wrote to memory of 512 1908 BA2C.exe cmd.exe PID 512 wrote to memory of 1068 512 cmd.exe timeout.exe PID 512 wrote to memory of 1068 512 cmd.exe timeout.exe PID 512 wrote to memory of 1068 512 cmd.exe timeout.exe PID 512 wrote to memory of 1068 512 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe"C:\Users\Admin\AppData\Local\Temp\23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1080
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\B941.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\B941.dll2⤵
- Loads dropped DLL
PID:1872
-
C:\Users\Admin\AppData\Local\Temp\BA2C.exeC:\Users\Admin\AppData\Local\Temp\BA2C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\BA2C.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:1068