General

  • Target

    7a17cc5e2f7fafb6e040e2ff30272bea15d58b6ac404974286ea1dedf559b7ee-20210418-062646

  • Size

    651KB

  • Sample

    210418-k4h8bafp36

  • MD5

    3d5917ec81fef2ab9f770af3718190e7

  • SHA1

    5c3dea2f2563e32d769e2b8bed5bcb61f9449af6

  • SHA256

    7a17cc5e2f7fafb6e040e2ff30272bea15d58b6ac404974286ea1dedf559b7ee

  • SHA512

    9505966104ab992c4f995d9c509721326ea928a133ffd4b8a365303a58680d29e290fb54e25f18b5a5bd284ce5be2a47d9ac694f4f24343c220756bdfe8d291c

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://185.215.113.28/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Botnet

169c5d05b5c705c55b29ba643be50dda8caffc2e

Attributes
  • url4cnc

    https://tttttt.me/umiumitfr3

rc4.plain
rc4.plain

Targets

    • Target

      7a17cc5e2f7fafb6e040e2ff30272bea15d58b6ac404974286ea1dedf559b7ee-20210418-062646

    • Size

      651KB

    • MD5

      3d5917ec81fef2ab9f770af3718190e7

    • SHA1

      5c3dea2f2563e32d769e2b8bed5bcb61f9449af6

    • SHA256

      7a17cc5e2f7fafb6e040e2ff30272bea15d58b6ac404974286ea1dedf559b7ee

    • SHA512

      9505966104ab992c4f995d9c509721326ea928a133ffd4b8a365303a58680d29e290fb54e25f18b5a5bd284ce5be2a47d9ac694f4f24343c220756bdfe8d291c

    • Modifies Windows Defender Real-time Protection settings

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Turns off Windows Defender SpyNet reporting

    • Windows security bypass

    • Nirsoft

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

5
T1112

Disabling Security Tools

4
T1089

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

2
T1005

Tasks