Analysis
- max time kernel
150s - max time network
140s - platform
windows10_x64 - resource
win10-en - submitted
19/09/2021, 12:36
General
- Target 09ad810630e8251be546dffede1480f3.exe
- Size 242KB
- Sample210919-psysxsefek
- SHA256 5dcdd9b2e6f81b11f4e4d0cb96709286deac6c8a8385d473f17d599ee55c150f
Malware Config
Extracted
-
smokeloader
-
2020
-
http://venerynnet1.top/
-
http://kevonahira2.top/
-
http://vegangelist3.top/
-
http://kingriffaele4.top/
-
http://arakeishant5.top/
Extracted
-
redline
-
UDP
-
45.9.20.20:13441
Extracted
-
redline
-
superstarlogs
-
94.26.249.88:32478
Signatures
- LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 4 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- suricata: ET MALWARE CerberTear Ransomware CnC Checkin
suricata: ET MALWARE CerberTear Ransomware CnC Checkin
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- LoaderBot executable 2 IoCs
- XMRig Miner Payload 5 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 8 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Drops startup file 1 IoCs
- Loads dropped DLL 5 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 34 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09ad810630e8251be546dffede1480f3.exe"C:\Users\Admin\AppData\Local\Temp\09ad810630e8251be546dffede1480f3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\09ad810630e8251be546dffede1480f3.exe"C:\Users\Admin\AppData\Local\Temp\09ad810630e8251be546dffede1480f3.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\6423.exeC:\Users\Admin\AppData\Local\Temp\6423.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\67FD.exeC:\Users\Admin\AppData\Local\Temp\67FD.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7183.exeC:\Users\Admin\AppData\Local\Temp\7183.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7183.exeC:\Users\Admin\AppData\Local\Temp\7183.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\7FBD.exeC:\Users\Admin\AppData\Local\Temp\7FBD.exe1⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45NMLtLi5oXXQsZycYkaFKCkXJUMijnPDSYj8YJ2bcfESMRiNmzZSxF4NTPRakuik3Lr2qmNqVKJzgAwaE4Xypyz4hyTaC5 -p x -k -v=0 --donate-level=1 -t 12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\8898.exeC:\Users\Admin\AppData\Local\Temp\8898.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\9952.exeC:\Users\Admin\AppData\Local\Temp\9952.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/496-227-0x00000150F8FE0000-0x00000150F9000000-memory.dmp
memory/496-237-0x00000150F9130000-0x00000150F9150000-memory.dmp
memory/496-229-0x00000150F9110000-0x00000150F9130000-memory.dmp
memory/1832-181-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-242-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-262-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-259-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-261-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-260-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/1832-258-0x0000000001250000-0x0000000001260000-memory.dmp
memory/1832-257-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-256-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-255-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-254-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-253-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/1832-251-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-252-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-250-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-249-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-247-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/1832-248-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-246-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-241-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-245-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/1832-244-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-243-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-179-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-173-0x0000000001250000-0x0000000001260000-memory.dmp
memory/1832-174-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-175-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-176-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-177-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-178-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-180-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-182-0x0000000005290000-0x00000000052A0000-memory.dmp
memory/1832-240-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-183-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-184-0x0000000005290000-0x00000000052A0000-memory.dmp
memory/1832-185-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-186-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-187-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-189-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-192-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-193-0x0000000005290000-0x00000000052A0000-memory.dmp
memory/1832-239-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-194-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-195-0x0000000003350000-0x0000000003360000-memory.dmp
memory/1832-238-0x0000000001250000-0x0000000001260000-memory.dmp
memory/1832-118-0x00000000011B0000-0x00000000011C5000-memory.dmp
memory/4188-198-0x00000000021F0000-0x00000000022C2000-memory.dmp
memory/4188-203-0x0000000000400000-0x0000000000563000-memory.dmp
memory/4208-207-0x0000000001320000-0x0000000001321000-memory.dmp
memory/4208-218-0x0000000005E80000-0x0000000005E81000-memory.dmp
memory/4208-217-0x0000000077750000-0x00000000778DE000-memory.dmp
memory/4524-117-0x0000000000030000-0x0000000000039000-memory.dmp
memory/4544-115-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4604-132-0x00000000056E0000-0x00000000056E1000-memory.dmp
memory/4604-199-0x0000000007100000-0x0000000007101000-memory.dmp
memory/4604-125-0x0000000000A00000-0x0000000000A1F000-memory.dmp
memory/4604-138-0x00000000026A0000-0x00000000026A1000-memory.dmp
memory/4604-137-0x0000000002510000-0x0000000002511000-memory.dmp
memory/4604-136-0x00000000022F4000-0x00000000022F6000-memory.dmp
memory/4604-197-0x0000000006B00000-0x0000000006B01000-memory.dmp
memory/4604-201-0x00000000074F0000-0x00000000074F1000-memory.dmp
memory/4604-127-0x00000000022D0000-0x00000000022EE000-memory.dmp
memory/4604-135-0x00000000022F3000-0x00000000022F4000-memory.dmp
memory/4604-196-0x0000000006930000-0x0000000006931000-memory.dmp
memory/4604-131-0x0000000000400000-0x0000000000460000-memory.dmp
memory/4604-129-0x00000000024E0000-0x00000000024E1000-memory.dmp
memory/4604-133-0x00000000022F0000-0x00000000022F1000-memory.dmp
memory/4604-130-0x00000000006C0000-0x00000000006F0000-memory.dmp
memory/4604-128-0x00000000050D0000-0x00000000050D1000-memory.dmp
memory/4604-134-0x00000000022F2000-0x00000000022F3000-memory.dmp
memory/4604-126-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
memory/4672-141-0x0000000000630000-0x00000000006C0000-memory.dmp
memory/4672-142-0x0000000000400000-0x0000000000493000-memory.dmp
memory/4796-144-0x0000000000F50000-0x0000000000F51000-memory.dmp
memory/4796-149-0x0000000005710000-0x0000000005786000-memory.dmp
memory/4796-147-0x0000000005740000-0x0000000005741000-memory.dmp
memory/4796-146-0x0000000005790000-0x0000000005791000-memory.dmp
memory/4900-155-0x0000000000400000-0x0000000000422000-memory.dmp
memory/4900-172-0x0000000004EA0000-0x00000000054A6000-memory.dmp
memory/4900-228-0x0000000007770000-0x0000000007771000-memory.dmp
memory/4964-163-0x00000000056F0000-0x00000000056F1000-memory.dmp
memory/4964-154-0x0000000000920000-0x0000000000921000-memory.dmp