Analysis
- max time kernel
152s - max time network
126s - platform
windows10_x64 - resource
win10v20210408 - submitted
05/09/2021, 06:26
General
- Target f8074a042d946f0290874b97f4b3d429.exe
- Size 235KB
- Sample210905-g687tabdek
- SHA256 42dbfa5efe80e105779d68ff235e542aea125899495f2c7feea11471531238fd
Malware Config
Extracted
-
smokeloader
-
2020
-
http://fioajfoiarjfoi1.xyz/
-
http://rdukhnihioh2.xyz/
-
http://sdfghjklemm3.xyz/
-
http://eruiopijhgnn4.xyz/
-
http://igbyugfwbwb5.xyz/
-
http://shfuhfuwhhc6.xyz/
-
http://ersyglhjkuij7.xyz/
-
http://ygyguguuju8.store/
-
http://resbkjpokfct9.store/
-
http://sdfygfygu10.store/
-
http://hbibhibihnj11.store/
-
http://vfwlkjhbghg12.store/
-
http://poiuytrcvb13.store/
-
http://xsedfgtbh14.store/
-
http://iknhyghggh15.store/
-
http://wnlonevkiju16.site/
-
http://gfyufuhhihioh17.site/
-
http://nsgiuwrevi18.site/
-
http://oiureveiuv19.site/
-
http://ovrnevnriuen20.site/
Extracted
-
redline
-
install
-
185.167.97.37:30904
Extracted
-
raccoon
-
fe582536ec580228180f270f7cb80a867860e010
-
url4cnc
https://telete.in/xylichanjk
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Downloads MZ/PE file
- Executes dropped EXE 4 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 6 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 5 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8074a042d946f0290874b97f4b3d429.exe"C:\Users\Admin\AppData\Local\Temp\f8074a042d946f0290874b97f4b3d429.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f8074a042d946f0290874b97f4b3d429.exe"C:\Users\Admin\AppData\Local\Temp\f8074a042d946f0290874b97f4b3d429.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\26E2.exeC:\Users\Admin\AppData\Local\Temp\26E2.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2F01.exeC:\Users\Admin\AppData\Local\Temp\2F01.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3BE3.exeC:\Users\Admin\AppData\Local\Temp\3BE3.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\4579.exeC:\Users\Admin\AppData\Local\Temp\4579.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 7322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 7442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 8442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 8642⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 8242⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/664-114-0x00000000024D0000-0x00000000024DA000-memory.dmp
memory/796-152-0x0000000077020000-0x00000000771AE000-memory.dmp
memory/796-146-0x0000000000810000-0x0000000000811000-memory.dmp
memory/796-153-0x0000000005980000-0x0000000005981000-memory.dmp
memory/796-181-0x00000000085D0000-0x00000000085D1000-memory.dmp
memory/2304-124-0x0000000005830000-0x0000000005831000-memory.dmp
memory/2304-164-0x00000000071E0000-0x00000000071E1000-memory.dmp
memory/2304-131-0x00000000058D0000-0x00000000058D1000-memory.dmp
memory/2304-175-0x0000000007920000-0x0000000007921000-memory.dmp
memory/2304-130-0x00000000057D0000-0x0000000005DD6000-memory.dmp
memory/2304-162-0x00000000079A0000-0x00000000079A1000-memory.dmp
memory/2304-160-0x00000000072A0000-0x00000000072A1000-memory.dmp
memory/2304-126-0x0000000005890000-0x0000000005891000-memory.dmp
memory/2304-125-0x0000000005960000-0x0000000005961000-memory.dmp
memory/2304-123-0x0000000005DE0000-0x0000000005DE1000-memory.dmp
memory/2304-121-0x0000000000EE0000-0x0000000000EE1000-memory.dmp
memory/3024-117-0x0000000000760000-0x0000000000776000-memory.dmp
memory/3168-158-0x0000000003E10000-0x0000000003E9F000-memory.dmp
memory/3168-159-0x0000000000400000-0x00000000021A0000-memory.dmp
memory/3232-115-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3488-140-0x0000000005510000-0x0000000005511000-memory.dmp
memory/3488-139-0x0000000077020000-0x00000000771AE000-memory.dmp
memory/3488-166-0x0000000007060000-0x0000000007061000-memory.dmp
memory/3488-168-0x0000000007F20000-0x0000000007F21000-memory.dmp
memory/3488-170-0x0000000007040000-0x0000000007041000-memory.dmp
memory/3488-133-0x0000000000C60000-0x0000000000C61000-memory.dmp