Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en
  • submitted
    10/09/2021, 13:31

General

  • Target
    66C36989BE74F756DE04E43A0E975242.exe
  • Size 246KB
  • Sample210910-qsc2wsdcbr
  • SHA256 37b4ecc82510180fafd3190e86be4d714caa2522f3475fd8e8debbacb6fc3e38
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • smokeloader

Version
  • 2020

C2
  • http://fazanaharahe1.xyz/

  • http://xandelissane2.xyz/

  • http://ustiassosale3.xyz/

  • http://cytheriata4.xyz/

  • http://ggiergionard5.xyz/

  • http://rrelleynaniy6.store/

  • http://danniemusoa7.store/

  • http://nastanizab8.store/

  • http://onyokandis9.store/

  • http://dmunaavank10.store/

  • http://gilmandros11.site/

  • http://cusanthana12.site/

  • http://willietjeana13.site/

  • http://ximusokall14.site/

  • http://blodinetisha15.site/

  • http://urydiahadyss16.club/

  • http://glasamaddama17.club/

  • http://marlingarly18.club/

  • http://alluvianna19.club/

  • http://xandirkaniel20.club/

rc4.i32
rc4.i32

Extracted

Family
  • redline

Botnet
  • installinfo8

C2
  • 146.70.35.170:30905

Extracted

Family
  • raccoon

Botnet
  • e89524de1a131be43c3cc9ec324dabb6a9998c12

Attributes
  • url4cnc

    https://telete.in/httpnotdetect1

rc4.plain
rc4.plain

Extracted

Family
  • raccoon

Botnet
  • 6e76410dbdf2085ebcf2777560bd8cb0790329c9

Attributes
  • url4cnc

    https://telete.in/bibiOutriggr1

rc4.plain
rc4.plain

Extracted

Family
  • redline

Botnet
  • proliv10ytro

C2
  • 45.14.49.167:5096

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 10 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Known Sinkhole Response Header

    suricata: ET MALWARE Known Sinkhole Response Header

  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • XMRig Miner Payload 4 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 21 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 9 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Modifies data under HKEY_USERS 12 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66C36989BE74F756DE04E43A0E975242.exe
    "C:\Users\Admin\AppData\Local\Temp\66C36989BE74F756DE04E43A0E975242.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3884
    • C:\Users\Admin\AppData\Local\Temp\66C36989BE74F756DE04E43A0E975242.exe
      "C:\Users\Admin\AppData\Local\Temp\66C36989BE74F756DE04E43A0E975242.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4028
  • C:\Users\Admin\AppData\Local\Temp\B6C3.exe
    C:\Users\Admin\AppData\Local\Temp\B6C3.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Users\Admin\AppData\Local\Temp\B6C3.exe
      C:\Users\Admin\AppData\Local\Temp\B6C3.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:2532
  • C:\Users\Admin\AppData\Local\Temp\BF01.exe
    C:\Users\Admin\AppData\Local\Temp\BF01.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3916
    • C:\Users\Admin\AppData\Local\Temp\BF01.exe
      C:\Users\Admin\AppData\Local\Temp\BF01.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3984
  • C:\Users\Admin\AppData\Local\Temp\C77E.exe
    C:\Users\Admin\AppData\Local\Temp\C77E.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3988
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xcyfgedp\
      2⤵
        PID:64
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\mtfsbopj.exe" C:\Windows\SysWOW64\xcyfgedp\
        2⤵
          PID:1252
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create xcyfgedp binPath= "C:\Windows\SysWOW64\xcyfgedp\mtfsbopj.exe /d\"C:\Users\Admin\AppData\Local\Temp\C77E.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1580
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description xcyfgedp "wifi internet conection"
            2⤵
              PID:2072
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start xcyfgedp
              2⤵
                PID:2508
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:3064
              • C:\Users\Admin\AppData\Local\Temp\CCAF.exe
                C:\Users\Admin\AppData\Local\Temp\CCAF.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:436
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\CCAF.exe"
                  2⤵
                    PID:2544
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /T 10 /NOBREAK
                      3⤵
                      • Delays execution with timeout.exe
                      PID:2880
                • C:\Windows\SysWOW64\xcyfgedp\mtfsbopj.exe
                  C:\Windows\SysWOW64\xcyfgedp\mtfsbopj.exe /d"C:\Users\Admin\AppData\Local\Temp\C77E.exe"
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:2872
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe
                    2⤵
                    • Drops file in System32 directory
                    • Suspicious use of SetThreadContext
                    • Modifies data under HKEY_USERS
                    PID:3128
                    • C:\Windows\SysWOW64\svchost.exe
                      svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                      3⤵
                        PID:4124
                  • C:\Users\Admin\AppData\Local\Temp\DD4A.exe
                    C:\Users\Admin\AppData\Local\Temp\DD4A.exe
                    1⤵
                    • Executes dropped EXE
                    • Checks BIOS information in registry
                    • Checks whether UAC is enabled
                    PID:3548
                  • C:\Users\Admin\AppData\Local\Temp\E460.exe
                    C:\Users\Admin\AppData\Local\Temp\E460.exe
                    1⤵
                    • Executes dropped EXE
                    PID:2472
                  • C:\Users\Admin\AppData\Local\Temp\FBE0.exe
                    C:\Users\Admin\AppData\Local\Temp\FBE0.exe
                    1⤵
                    • Executes dropped EXE
                    • Checks BIOS information in registry
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious use of AdjustPrivilegeToken
                    PID:872
                  • C:\Users\Admin\AppData\Local\Temp\1FC.exe
                    C:\Users\Admin\AppData\Local\Temp\1FC.exe
                    1⤵
                    • Executes dropped EXE
                    PID:3280
                  • C:\Users\Admin\AppData\Local\Temp\1C1C.exe
                    C:\Users\Admin\AppData\Local\Temp\1C1C.exe
                    1⤵
                    • Executes dropped EXE
                    • Checks BIOS information in registry
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Checks processor information in registry
                    PID:2260
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\AGfLtTwYQU & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1C1C.exe"
                      2⤵
                      • Blocklisted process makes network request
                      • Loads dropped DLL
                      PID:3280
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 4
                        3⤵
                        • Delays execution with timeout.exe
                        PID:4428
                  • C:\Users\Admin\AppData\Local\Temp\20C1.exe
                    C:\Users\Admin\AppData\Local\Temp\20C1.exe
                    1⤵
                    • Executes dropped EXE
                    PID:420
                  • C:\Users\Admin\AppData\Local\Temp\293E.exe
                    C:\Users\Admin\AppData\Local\Temp\293E.exe
                    1⤵
                    • Executes dropped EXE
                    PID:4148
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
                      2⤵
                        PID:4348
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
                        2⤵
                          PID:1272
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
                          2⤵
                            PID:4448
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
                            2⤵
                              PID:4524
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
                              2⤵
                                PID:1556
                            • C:\Users\Admin\AppData\Local\Temp\315D.exe
                              C:\Users\Admin\AppData\Local\Temp\315D.exe
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:4440
                              • C:\Users\Admin\AppData\Local\Temp\315D.exe
                                "C:\Users\Admin\AppData\Local\Temp\315D.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:4824
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 1532
                                2⤵
                                • Program crash
                                PID:1560
                            • C:\Users\Admin\AppData\Local\Temp\368E.exe
                              C:\Users\Admin\AppData\Local\Temp\368E.exe
                              1⤵
                              • Executes dropped EXE
                              PID:4584
                            • C:\Users\Admin\AppData\Local\Temp\3DD2.exe
                              C:\Users\Admin\AppData\Local\Temp\3DD2.exe
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:4708
                              • C:\Users\Admin\AppData\Local\Temp\3DD2.exe
                                "C:\Users\Admin\AppData\Local\Temp\3DD2.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:5092
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1484
                                2⤵
                                • Program crash
                                PID:192
                            • C:\Users\Admin\AppData\Local\Temp\446B.exe
                              C:\Users\Admin\AppData\Local\Temp\446B.exe
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:4804
                              • C:\Users\Admin\AppData\Local\Temp\446B.exe
                                "C:\Users\Admin\AppData\Local\Temp\446B.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:2820
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 1484
                                2⤵
                                • Program crash
                                PID:752

                            Network

                                  MITRE ATT&CK Enterprise v6

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  memory/420-249-0x0000000005690000-0x0000000005C96000-memory.dmp

                                  memory/420-239-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                                  memory/436-160-0x0000000002E50000-0x0000000002EDF000-memory.dmp

                                  memory/436-161-0x0000000000400000-0x0000000002B99000-memory.dmp

                                  memory/872-208-0x00000000002B0000-0x00000000002B1000-memory.dmp

                                  memory/872-217-0x0000000005760000-0x0000000005D66000-memory.dmp

                                  memory/872-214-0x0000000076EA0000-0x000000007702E000-memory.dmp

                                  memory/1272-465-0x000001DE19B90000-0x000001DE19B92000-memory.dmp

                                  memory/1272-466-0x000001DE19B93000-0x000001DE19B95000-memory.dmp

                                  memory/1272-502-0x000001DE19B96000-0x000001DE19B98000-memory.dmp

                                  memory/1556-807-0x000002294F850000-0x000002294F852000-memory.dmp

                                  memory/1556-810-0x000002294F856000-0x000002294F858000-memory.dmp

                                  memory/1556-808-0x000002294F853000-0x000002294F855000-memory.dmp

                                  memory/2112-118-0x0000000002C00000-0x0000000002C16000-memory.dmp

                                  memory/2112-157-0x0000000002C60000-0x0000000002C76000-memory.dmp

                                  memory/2260-230-0x0000000000D21000-0x0000000000D50000-memory.dmp

                                  memory/2260-225-0x0000000000D20000-0x000000000145D000-memory.dmp

                                  memory/2260-231-0x0000000076EA0000-0x000000007702E000-memory.dmp

                                  memory/2472-196-0x0000000003E40000-0x0000000003ECF000-memory.dmp

                                  memory/2472-200-0x0000000000400000-0x000000000218B000-memory.dmp

                                  memory/2820-501-0x0000000005400000-0x0000000005A06000-memory.dmp

                                  memory/2872-182-0x0000000002290000-0x00000000023DA000-memory.dmp

                                  memory/2872-183-0x0000000000400000-0x0000000002149000-memory.dmp

                                  memory/2976-125-0x0000000002150000-0x00000000021FE000-memory.dmp

                                  memory/3128-184-0x0000000000BB0000-0x0000000000BC5000-memory.dmp

                                  memory/3280-219-0x0000000002290000-0x00000000023DA000-memory.dmp

                                  memory/3280-220-0x0000000000400000-0x000000000218B000-memory.dmp

                                  memory/3548-177-0x0000000005320000-0x0000000005926000-memory.dmp

                                  memory/3548-171-0x0000000001390000-0x0000000001391000-memory.dmp

                                  memory/3884-117-0x0000000002BE0000-0x0000000002D2A000-memory.dmp

                                  memory/3916-133-0x0000000005F60000-0x0000000005F61000-memory.dmp

                                  memory/3916-134-0x0000000005A50000-0x0000000005A51000-memory.dmp

                                  memory/3916-132-0x0000000003280000-0x0000000003281000-memory.dmp

                                  memory/3916-131-0x0000000005800000-0x0000000005801000-memory.dmp

                                  memory/3916-129-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

                                  memory/3984-195-0x0000000007220000-0x0000000007221000-memory.dmp

                                  memory/3984-193-0x0000000007750000-0x0000000007751000-memory.dmp

                                  memory/3984-156-0x0000000005690000-0x0000000005C96000-memory.dmp

                                  memory/3984-154-0x00000000057F0000-0x00000000057F1000-memory.dmp

                                  memory/3984-192-0x0000000007050000-0x0000000007051000-memory.dmp

                                  memory/3984-153-0x00000000057B0000-0x00000000057B1000-memory.dmp

                                  memory/3984-151-0x0000000005850000-0x0000000005851000-memory.dmp

                                  memory/3984-150-0x0000000005720000-0x0000000005721000-memory.dmp

                                  memory/3984-141-0x0000000000400000-0x0000000000422000-memory.dmp

                                  memory/3984-198-0x0000000007530000-0x0000000007531000-memory.dmp

                                  memory/3984-149-0x0000000005CA0000-0x0000000005CA1000-memory.dmp

                                  memory/3988-144-0x0000000000400000-0x0000000002149000-memory.dmp

                                  memory/3988-142-0x0000000003D30000-0x0000000003D43000-memory.dmp

                                  memory/4028-115-0x0000000000400000-0x0000000000409000-memory.dmp

                                  memory/4124-250-0x0000000002F00000-0x0000000002FF1000-memory.dmp

                                  memory/4124-260-0x0000000002F00000-0x0000000002FF1000-memory.dmp

                                  memory/4148-264-0x0000000002EB0000-0x0000000002EB2000-memory.dmp

                                  memory/4148-258-0x0000000000780000-0x0000000000781000-memory.dmp

                                  memory/4148-261-0x000000001EC80000-0x000000001ED1F000-memory.dmp

                                  memory/4348-280-0x0000025B38003000-0x0000025B38005000-memory.dmp

                                  memory/4348-349-0x0000025B38006000-0x0000025B38008000-memory.dmp

                                  memory/4348-278-0x0000025B38000000-0x0000025B38002000-memory.dmp

                                  memory/4440-295-0x0000000005520000-0x0000000005A1E000-memory.dmp

                                  memory/4440-290-0x0000000005520000-0x0000000005A1E000-memory.dmp

                                  memory/4440-292-0x0000000005520000-0x0000000005A1E000-memory.dmp

                                  memory/4440-296-0x0000000005520000-0x0000000005A1E000-memory.dmp

                                  memory/4448-636-0x000001A3567A6000-0x000001A3567A8000-memory.dmp

                                  memory/4448-594-0x000001A3567A3000-0x000001A3567A5000-memory.dmp

                                  memory/4448-593-0x000001A3567A0000-0x000001A3567A2000-memory.dmp

                                  memory/4524-703-0x000001F046310000-0x000001F046312000-memory.dmp

                                  memory/4524-704-0x000001F046313000-0x000001F046315000-memory.dmp

                                  memory/4524-728-0x000001F046316000-0x000001F046318000-memory.dmp

                                  memory/4584-344-0x0000000006933000-0x0000000006934000-memory.dmp

                                  memory/4584-330-0x00000000001C0000-0x00000000001F0000-memory.dmp

                                  memory/4584-336-0x0000000006934000-0x0000000006936000-memory.dmp

                                  memory/4584-341-0x0000000000400000-0x0000000002164000-memory.dmp

                                  memory/4584-343-0x0000000006932000-0x0000000006933000-memory.dmp

                                  memory/4584-342-0x0000000006930000-0x0000000006931000-memory.dmp

                                  memory/4708-311-0x0000000005520000-0x0000000005A1E000-memory.dmp

                                  memory/4708-309-0x0000000005520000-0x0000000005A1E000-memory.dmp

                                  memory/4708-315-0x0000000005520000-0x0000000005A1E000-memory.dmp

                                  memory/4708-317-0x0000000005520000-0x0000000005A1E000-memory.dmp

                                  memory/4804-334-0x00000000057B0000-0x0000000005CAE000-memory.dmp

                                  memory/4804-332-0x00000000057B0000-0x0000000005CAE000-memory.dmp

                                  memory/4804-338-0x00000000057B0000-0x0000000005CAE000-memory.dmp

                                  memory/4804-340-0x00000000057B0000-0x0000000005CAE000-memory.dmp

                                  memory/4824-445-0x0000000005420000-0x0000000005A26000-memory.dmp

                                  memory/5092-480-0x0000000005200000-0x0000000005806000-memory.dmp