Analysis
-
max time kernel
158s -
max time network
164s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
30/08/2021, 06:35
Static task
static1
Behavioral task
behavioral1
Sample
70d323a19c27af9c38bbda35359fd92f.exe
Resource
win7v20210408
raccoonsmokeloaderfe582536ec580228180f270f7cb80a867860e010backdoordiscoveryevasionspywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
70d323a19c27af9c38bbda35359fd92f.exe
Resource
win10v20210408
buranraccoonredlinesmokeloaderd02c5d65069fc7ce1993e7c52edf0c9c4c195c81nnbackdoordiscoveryevasioninfostealerpersistenceransomwarespywarestealerthemidatrojan
windows10_x64
0 signatures
0 seconds
General
-
Target
70d323a19c27af9c38bbda35359fd92f.exe
-
Size
213KB
-
MD5
70d323a19c27af9c38bbda35359fd92f
-
SHA1
f89b2639344b438d9f20d9f6c88ec7333e9d6060
-
SHA256
c85c4e2e3f1e39dadeef2a82c4faafe45fb5098236b62d9c821b91c915b66ebb
-
SHA512
4e8a40d47d0253ef5f4e9676a925b27e5d7bda11b44a68404e0f4ceee69fc6647be8d38f9066ccb7e04b1cf6f352f6d702a55624a6732dbfd11858b3521bb8d3
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
rc4.i32
rc4.i32
Extracted
Family
raccoon
Botnet
fe582536ec580228180f270f7cb80a867860e010
Attributes
-
url4cnc
https://telete.in/xylichanjk
rc4.plain
rc4.plain
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
pid Process 892 58BA.exe 1168 5D2E.exe 1040 B34A.exe 784 B7DD.exe 1604 B935.exe 1308 BA01.exe -
Deletes itself 1 IoCs
pid Process 1204 Process not Found -
Loads dropped DLL 7 IoCs
pid Process 1168 5D2E.exe 1168 5D2E.exe 1168 5D2E.exe 1168 5D2E.exe 1168 5D2E.exe 1168 5D2E.exe 1168 5D2E.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x00050000000130cf-85.dat themida behavioral1/memory/784-94-0x0000000000270000-0x0000000000271000-memory.dmp themida -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA B7DD.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 880 set thread context of 2044 880 70d323a19c27af9c38bbda35359fd92f.exe 26 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 70d323a19c27af9c38bbda35359fd92f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 70d323a19c27af9c38bbda35359fd92f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 70d323a19c27af9c38bbda35359fd92f.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 5D2E.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 5D2E.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2044 70d323a19c27af9c38bbda35359fd92f.exe 2044 70d323a19c27af9c38bbda35359fd92f.exe 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1204 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2044 70d323a19c27af9c38bbda35359fd92f.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 1204 Process not Found Token: SeShutdownPrivilege 1204 Process not Found -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 892 58BA.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 880 wrote to memory of 2044 880 70d323a19c27af9c38bbda35359fd92f.exe 26 PID 880 wrote to memory of 2044 880 70d323a19c27af9c38bbda35359fd92f.exe 26 PID 880 wrote to memory of 2044 880 70d323a19c27af9c38bbda35359fd92f.exe 26 PID 880 wrote to memory of 2044 880 70d323a19c27af9c38bbda35359fd92f.exe 26 PID 880 wrote to memory of 2044 880 70d323a19c27af9c38bbda35359fd92f.exe 26 PID 880 wrote to memory of 2044 880 70d323a19c27af9c38bbda35359fd92f.exe 26 PID 880 wrote to memory of 2044 880 70d323a19c27af9c38bbda35359fd92f.exe 26 PID 1204 wrote to memory of 892 1204 Process not Found 30 PID 1204 wrote to memory of 892 1204 Process not Found 30 PID 1204 wrote to memory of 892 1204 Process not Found 30 PID 1204 wrote to memory of 892 1204 Process not Found 30 PID 1204 wrote to memory of 1168 1204 Process not Found 31 PID 1204 wrote to memory of 1168 1204 Process not Found 31 PID 1204 wrote to memory of 1168 1204 Process not Found 31 PID 1204 wrote to memory of 1168 1204 Process not Found 31 PID 1204 wrote to memory of 1040 1204 Process not Found 33 PID 1204 wrote to memory of 1040 1204 Process not Found 33 PID 1204 wrote to memory of 1040 1204 Process not Found 33 PID 1204 wrote to memory of 1040 1204 Process not Found 33 PID 1204 wrote to memory of 784 1204 Process not Found 35 PID 1204 wrote to memory of 784 1204 Process not Found 35 PID 1204 wrote to memory of 784 1204 Process not Found 35 PID 1204 wrote to memory of 784 1204 Process not Found 35 PID 1204 wrote to memory of 784 1204 Process not Found 35 PID 1204 wrote to memory of 784 1204 Process not Found 35 PID 1204 wrote to memory of 784 1204 Process not Found 35 PID 1204 wrote to memory of 1604 1204 Process not Found 37 PID 1204 wrote to memory of 1604 1204 Process not Found 37 PID 1204 wrote to memory of 1604 1204 Process not Found 37 PID 1204 wrote to memory of 1604 1204 Process not Found 37 PID 1204 wrote to memory of 1308 1204 Process not Found 38 PID 1204 wrote to memory of 1308 1204 Process not Found 38 PID 1204 wrote to memory of 1308 1204 Process not Found 38 PID 1204 wrote to memory of 1308 1204 Process not Found 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\70d323a19c27af9c38bbda35359fd92f.exe"C:\Users\Admin\AppData\Local\Temp\70d323a19c27af9c38bbda35359fd92f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\70d323a19c27af9c38bbda35359fd92f.exe"C:\Users\Admin\AppData\Local\Temp\70d323a19c27af9c38bbda35359fd92f.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2044
-
-
C:\Users\Admin\AppData\Local\Temp\58BA.exeC:\Users\Admin\AppData\Local\Temp\58BA.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:892
-
C:\Users\Admin\AppData\Local\Temp\5D2E.exeC:\Users\Admin\AppData\Local\Temp\5D2E.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1168
-
C:\Users\Admin\AppData\Local\Temp\B34A.exeC:\Users\Admin\AppData\Local\Temp\B34A.exe1⤵
- Executes dropped EXE
PID:1040
-
C:\Users\Admin\AppData\Local\Temp\B7DD.exeC:\Users\Admin\AppData\Local\Temp\B7DD.exe1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:784
-
C:\Users\Admin\AppData\Local\Temp\B935.exeC:\Users\Admin\AppData\Local\Temp\B935.exe1⤵
- Executes dropped EXE
PID:1604
-
C:\Users\Admin\AppData\Local\Temp\BA01.exeC:\Users\Admin\AppData\Local\Temp\BA01.exe1⤵
- Executes dropped EXE
PID:1308
-
C:\Users\Admin\AppData\Local\Temp\BCC0.exeC:\Users\Admin\AppData\Local\Temp\BCC0.exe1⤵PID:1524
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1364