Analysis

  • max time kernel
    93s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    09/08/2021, 20:56

General

  • Target
    15FD29325E11AA1777BDDE1E09829784.exe
  • Size 3.2MB
  • Sample210809-cfcvf6bbvn
  • SHA256 2ec6c6341ff83005a6515d942976d2092549312d419a29e59d0efb15d65749bf
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • smokeloader

Version
  • 2020

C2
  • http://conceitosseg.com/upload/

  • http://integrasidata.com/upload/

  • http://ozentekstil.com/upload/

  • http://finbelportal.com/upload/

  • http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Extracted

Family
  • raccoon

Botnet
  • 9fd53b475fc64a3ea667b6e92477d7b54c1560a6

Attributes
  • url4cnc

    https://telete.in/comnixlinnf4

rc4.plain
rc4.plain

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon Stealer Payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • suricata: ET MALWARE Possible Dridex Download URI Struct with no referer

    suricata: ET MALWARE Possible Dridex Download URI Struct with no referer

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • Downloads MZ/PE file
  • Executes dropped EXE 19 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 8 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • autoit_exe 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
    • Drops file in System32 directory
    PID:860
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Themes
    1⤵
      PID:1252
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s SENS
      1⤵
        PID:1412
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
        1⤵
          PID:1844
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
            PID:2416
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s WpnService
            1⤵
              PID:2628
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s Browser
              1⤵
                PID:2852
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2620
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                1⤵
                  PID:2424
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1232
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1080
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                      1⤵
                        PID:1000
                      • C:\Users\Admin\AppData\Local\Temp\15FD29325E11AA1777BDDE1E09829784.exe
                        "C:\Users\Admin\AppData\Local\Temp\15FD29325E11AA1777BDDE1E09829784.exe"
                        1⤵
                        • Checks computer location settings
                        • Suspicious use of WriteProcessMemory
                        PID:3716
                        • C:\Users\Admin\AppData\Local\Temp\Files.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files.exe"
                          2⤵
                          • Executes dropped EXE
                          • Checks computer location settings
                          • Suspicious use of WriteProcessMemory
                          PID:2660
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of WriteProcessMemory
                            PID:2152
                            • C:\Users\Public\run.exe
                              C:\Users\Public\run.exe
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Suspicious use of WriteProcessMemory
                              PID:2328
                              • C:\Users\Public\run.exe
                                C:\Users\Public\run.exe
                                5⤵
                                • Executes dropped EXE
                                PID:5080
                              • C:\Users\Public\run.exe
                                C:\Users\Public\run.exe
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:2644
                              • C:\Users\Public\run.exe
                                C:\Users\Public\run.exe
                                5⤵
                                • Executes dropped EXE
                                PID:352
                        • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                          "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:1196
                          • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                            "C:\Users\Admin\AppData\Local\Temp\Folder.exe" -a
                            3⤵
                            • Executes dropped EXE
                            PID:4416
                        • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                          "C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
                          2⤵
                            PID:3964
                          • C:\Users\Admin\AppData\Local\Temp\Info.exe
                            "C:\Users\Admin\AppData\Local\Temp\Info.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:4128
                            • C:\Users\Admin\Documents\vyv1sCJILxLbgyqfFUauFOOA.exe
                              "C:\Users\Admin\Documents\vyv1sCJILxLbgyqfFUauFOOA.exe"
                              3⤵
                              • Executes dropped EXE
                              PID:5176
                            • C:\Users\Admin\Documents\nQC8wy9yTgOgkDacDWUBG6AB.exe
                              "C:\Users\Admin\Documents\nQC8wy9yTgOgkDacDWUBG6AB.exe"
                              3⤵
                              • Executes dropped EXE
                              PID:5164
                            • C:\Users\Admin\Documents\AD4dcNqK2TOGdNh5oEqHUl6x.exe
                              "C:\Users\Admin\Documents\AD4dcNqK2TOGdNh5oEqHUl6x.exe"
                              3⤵
                              • Executes dropped EXE
                              PID:5152
                            • C:\Users\Admin\Documents\UW2QIYTukcA6bDENibS8Pjsg.exe
                              "C:\Users\Admin\Documents\UW2QIYTukcA6bDENibS8Pjsg.exe"
                              3⤵
                              • Executes dropped EXE
                              PID:5248
                            • C:\Users\Admin\Documents\oTj0t78ORH2nMamUBGetCrBn.exe
                              "C:\Users\Admin\Documents\oTj0t78ORH2nMamUBGetCrBn.exe"
                              3⤵
                              • Executes dropped EXE
                              PID:5232
                            • C:\Users\Admin\Documents\xGaHp6rfuq4mk50P5sy5asNl.exe
                              "C:\Users\Admin\Documents\xGaHp6rfuq4mk50P5sy5asNl.exe"
                              3⤵
                              • Executes dropped EXE
                              PID:5220
                            • C:\Users\Admin\Documents\kL4L08WIlRCcf91XQUi6oIuJ.exe
                              "C:\Users\Admin\Documents\kL4L08WIlRCcf91XQUi6oIuJ.exe"
                              3⤵
                                PID:5364
                              • C:\Users\Admin\Documents\ggcSJfvDMBPmMtFut2on8Gsp.exe
                                "C:\Users\Admin\Documents\ggcSJfvDMBPmMtFut2on8Gsp.exe"
                                3⤵
                                  PID:5372
                                • C:\Users\Admin\Documents\TQxr_KDVKavoWI8rpzdHU9pf.exe
                                  "C:\Users\Admin\Documents\TQxr_KDVKavoWI8rpzdHU9pf.exe"
                                  3⤵
                                    PID:5272
                                  • C:\Users\Admin\Documents\fY2UFQntL8jiUL7MZBlMZK1t.exe
                                    "C:\Users\Admin\Documents\fY2UFQntL8jiUL7MZBlMZK1t.exe"
                                    3⤵
                                      PID:5280
                                    • C:\Users\Admin\Documents\3DBRiFCiaUkryEQUmVJahEhU.exe
                                      "C:\Users\Admin\Documents\3DBRiFCiaUkryEQUmVJahEhU.exe"
                                      3⤵
                                        PID:5500
                                      • C:\Users\Admin\Documents\ec9AvQCNt6mMDPCO81Qbakqw.exe
                                        "C:\Users\Admin\Documents\ec9AvQCNt6mMDPCO81Qbakqw.exe"
                                        3⤵
                                          PID:5492
                                        • C:\Users\Admin\Documents\8UG_r6A5A7QzUGCYTkaqNSks.exe
                                          "C:\Users\Admin\Documents\8UG_r6A5A7QzUGCYTkaqNSks.exe"
                                          3⤵
                                            PID:5572
                                          • C:\Users\Admin\Documents\SIAZFTtwvkBQW9YRO7Kkgdxk.exe
                                            "C:\Users\Admin\Documents\SIAZFTtwvkBQW9YRO7Kkgdxk.exe"
                                            3⤵
                                              PID:5564
                                          • C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
                                            "C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            PID:4172
                                          • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            • Modifies system certificate store
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:4240
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd.exe /c taskkill /f /im chrome.exe
                                              3⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4424
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /f /im chrome.exe
                                                4⤵
                                                • Executes dropped EXE
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3964
                                          • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                            "C:\Users\Admin\AppData\Local\Temp\pub2.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Checks SCSI registry key(s)
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious behavior: MapViewOfSection
                                            PID:4272
                                        • \??\c:\windows\system32\svchost.exe
                                          c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                          1⤵
                                          • Suspicious use of SetThreadContext
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:500
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                            2⤵
                                            • Checks processor information in registry
                                            • Modifies data under HKEY_USERS
                                            • Modifies registry class
                                            PID:4756
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                            2⤵
                                            • Drops file in System32 directory
                                            • Checks processor information in registry
                                            • Modifies data under HKEY_USERS
                                            • Modifies registry class
                                            PID:4944
                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                          1⤵
                                          • Drops file in Windows directory
                                          • Modifies Internet Explorer settings
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1808
                                        • C:\Windows\system32\browser_broker.exe
                                          C:\Windows\system32\browser_broker.exe -Embedding
                                          1⤵
                                          • Modifies Internet Explorer settings
                                          PID:3892
                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                          1⤵
                                          • Modifies registry class
                                          • Suspicious behavior: MapViewOfSection
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:4496
                                        • C:\Windows\system32\rUNdlL32.eXe
                                          rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Suspicious use of WriteProcessMemory
                                          PID:4628
                                          • C:\Windows\SysWOW64\rundll32.exe
                                            rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                            2⤵
                                            • Loads dropped DLL
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:4664
                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                          1⤵
                                          • Modifies registry class
                                          PID:4676
                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                          1⤵
                                          • Modifies Internet Explorer settings
                                          • Modifies registry class
                                          PID:4228
                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                          1⤵
                                          • Modifies registry class
                                          PID:4416
                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                          1⤵
                                          • Modifies registry class
                                          PID:4788
                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                          1⤵
                                          • Modifies registry class
                                          PID:5040

                                        Network

                                              MITRE ATT&CK Enterprise v6

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              memory/500-182-0x0000023B80440000-0x0000023B804B1000-memory.dmp

                                              memory/500-181-0x0000023B80380000-0x0000023B803CC000-memory.dmp

                                              memory/860-180-0x000002DE7B830000-0x000002DE7B8A1000-memory.dmp

                                              memory/1000-190-0x0000023AACF10000-0x0000023AACF81000-memory.dmp

                                              memory/1080-198-0x0000021265D30000-0x0000021265DA1000-memory.dmp

                                              memory/1232-207-0x000002BDB2210000-0x000002BDB2281000-memory.dmp

                                              memory/1252-199-0x0000019FE3180000-0x0000019FE31F1000-memory.dmp

                                              memory/1412-188-0x00000234F8B50000-0x00000234F8BC1000-memory.dmp

                                              memory/1844-194-0x000002022E270000-0x000002022E2E1000-memory.dmp

                                              memory/2328-229-0x0000000004B50000-0x0000000004B51000-memory.dmp

                                              memory/2328-226-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

                                              memory/2328-227-0x0000000004AF0000-0x0000000004AF7000-memory.dmp

                                              memory/2328-228-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

                                              memory/2328-139-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                              memory/2416-193-0x000002212F640000-0x000002212F6B1000-memory.dmp

                                              memory/2424-192-0x0000023641140000-0x00000236411B1000-memory.dmp

                                              memory/2620-208-0x000001EA89D80000-0x000001EA89DF1000-memory.dmp

                                              memory/2628-209-0x000001F581810000-0x000001F581881000-memory.dmp

                                              memory/2644-232-0x0000000000400000-0x0000000000495000-memory.dmp

                                              memory/2644-235-0x0000000000400000-0x0000000000495000-memory.dmp

                                              memory/2852-186-0x000002D932400000-0x000002D932471000-memory.dmp

                                              memory/3000-220-0x0000000002790000-0x00000000027A5000-memory.dmp

                                              memory/3964-144-0x00000000007E0000-0x00000000007E1000-memory.dmp

                                              memory/3964-155-0x000000001ACE0000-0x000000001ACE2000-memory.dmp

                                              memory/3964-152-0x0000000000810000-0x0000000000811000-memory.dmp

                                              memory/3964-151-0x00000000007F0000-0x000000000080D000-memory.dmp

                                              memory/3964-133-0x00000000000B0000-0x00000000000B1000-memory.dmp

                                              memory/4172-261-0x0000000006420000-0x0000000006428000-memory.dmp

                                              memory/4172-263-0x0000000004A40000-0x0000000004A48000-memory.dmp

                                              memory/4172-264-0x00000000033C0000-0x0000000003420000-memory.dmp

                                              memory/4172-270-0x0000000003560000-0x00000000035C0000-memory.dmp

                                              memory/4172-258-0x0000000004A40000-0x0000000004A48000-memory.dmp

                                              memory/4172-247-0x0000000003560000-0x0000000003570000-memory.dmp

                                              memory/4172-241-0x00000000033C0000-0x00000000033D0000-memory.dmp

                                              memory/4172-150-0x0000000000400000-0x00000000005DB000-memory.dmp

                                              memory/4172-255-0x0000000006420000-0x0000000006428000-memory.dmp

                                              memory/4172-254-0x0000000004AE0000-0x0000000004AE8000-memory.dmp

                                              memory/4172-253-0x00000000047A0000-0x00000000047A8000-memory.dmp

                                              memory/4272-179-0x0000000000400000-0x00000000009B1000-memory.dmp

                                              memory/4272-196-0x00000000001E0000-0x00000000001E9000-memory.dmp

                                              memory/4664-177-0x0000000003460000-0x00000000034BD000-memory.dmp

                                              memory/4664-160-0x0000000004F56000-0x0000000005057000-memory.dmp

                                              memory/4756-187-0x000002B528500000-0x000002B528571000-memory.dmp

                                              memory/4944-224-0x0000019307E00000-0x0000019307E4E000-memory.dmp

                                              memory/4944-239-0x0000019309910000-0x000001930992B000-memory.dmp

                                              memory/4944-240-0x000001930A900000-0x000001930AA06000-memory.dmp

                                              memory/4944-225-0x00000193080D0000-0x0000019308144000-memory.dmp