Analysis
- max time kernel
152s - max time network
151s - platform
windows10_x64 - resource
win10v20210410 - submitted
23/08/2021, 17:54
General
- Target a4fe313256e5477d41af77aa45c65f20.exe
- Size 274KB
- Sample210823-wsg5ffd3ra
- SHA256 04b094e1e2f34f1382df94fa610e9e74a74e6a73c8b755285a70f60da73b392d
Malware Config
Extracted
-
smokeloader
-
2020
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
Extracted
-
raccoon
-
fd34ae8fb78d0554aa7caf12c271e01efb3342f6
-
url4cnc
https://telete.in/jinnlitena1
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Deletes itself 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4fe313256e5477d41af77aa45c65f20.exe"C:\Users\Admin\AppData\Local\Temp\a4fe313256e5477d41af77aa45c65f20.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\BBB4.exeC:\Users\Admin\AppData\Local\Temp\BBB4.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1172-120-0x0000000004050000-0x00000000040DF000-memory.dmp
memory/1172-121-0x0000000000400000-0x00000000023EE000-memory.dmp
memory/2492-116-0x0000000001310000-0x0000000001326000-memory.dmp
memory/3968-115-0x0000000000400000-0x00000000023AE000-memory.dmp
memory/3968-114-0x0000000002400000-0x0000000002409000-memory.dmp