Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    24-09-2021 22:05

General

  • Target

    e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe

  • Size

    287KB

  • MD5

    6cbf95206889d06445d284b862cf18bf

  • SHA1

    c85b2f93e81da0d5759f195afdf91a645343fe5d

  • SHA256

    e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cfbf9fc9ed24d8dc7d143

  • SHA512

    45d81eddf9e9c38ed9b8ec6510b6b34c752c5ccc01e22028549ef19921308a8531dbb8c5f9f79833e5df350dd47dc2a3edd430926d45f4f1f31fd329c50393e4

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

2k superstar

C2

185.244.180.224:39957

Extracted

Family

raccoon

Botnet

d4d8e30c16491ca1c11f7aa675764335342faedf

Attributes
  • url4cnc

    https://t.me/hcdrom1

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes
  • url4cnc

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe
    "C:\Users\Admin\AppData\Local\Temp\e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1424
    • C:\Users\Admin\AppData\Local\Temp\e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe
      "C:\Users\Admin\AppData\Local\Temp\e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1120
  • C:\Users\Admin\AppData\Local\Temp\2E.exe
    C:\Users\Admin\AppData\Local\Temp\2E.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1636
  • C:\Users\Admin\AppData\Local\Temp\77F.exe
    C:\Users\Admin\AppData\Local\Temp\77F.exe
    1⤵
    • Executes dropped EXE
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:952
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AG8AcAAtAHAAcgBvAGMAZQBzAHMAIAAtAEkAZAAgADkANQAyADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAbwBrAGcAbwB1AHUALgBlAHgAZQAiADsAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAzADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwANwA3AEYALgBlAHgAZQAiACAALQBGAG8AcgBjAGUA
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:560
      • C:\Users\Admin\AppData\Local\Temp\okgouu.exe
        "C:\Users\Admin\AppData\Local\Temp\okgouu.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1696
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\voxudocww.vbs"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:812
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:760
  • C:\Users\Admin\AppData\Local\Temp\CFC.exe
    C:\Users\Admin\AppData\Local\Temp\CFC.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1200
  • C:\Users\Admin\AppData\Local\Temp\10F3.exe
    C:\Users\Admin\AppData\Local\Temp\10F3.exe
    1⤵
    • Executes dropped EXE
    PID:560

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\10F3.exe

    MD5

    885cb6e5ebea328d840713882a7ff412

    SHA1

    7a8f0cfa23054e9bf2a16222d9a02aa80546d55a

    SHA256

    8705fa55cba407024395f636436eb29457d26c954ea2d581d0d19afade1ee3ea

    SHA512

    084ef9ba8ad7a594a30545b2214328863903167a433052954f47efb3f8041e135cd40a4441e7172563647deb66fff93a3543960456d07e21a5f22f3d96d613a3

  • C:\Users\Admin\AppData\Local\Temp\2E.exe

    MD5

    4266f72b05afa83f395e890b76eadf69

    SHA1

    489386ba56760821f6e35712028410da476fe258

    SHA256

    6b1e04d8ef0395166da7d784c80ec3b8e85593ec862e54c07976ef14b28c70e4

    SHA512

    a375f17bc9283e7edb8f492d616ec3f192d9943251a4323138c99b565dbb03a5734b4116b7b47830680dea16713155cb96e51ea32ce96f479c48e9bd0bb9556a

  • C:\Users\Admin\AppData\Local\Temp\77F.exe

    MD5

    0a465be9c75469e6f2398b2668a2c5f2

    SHA1

    9b610498a08345fe3280b6c79ed4b5d1945d6a79

    SHA256

    eca0040a928bb7f215b2379bf40b65397d4ead565ab8ad9a19c61740228e9f33

    SHA512

    eaa28aafc65e1d847f292e9e43279913b737bfb6649758548df11ebbb3de7c8c6c8e0568091b7f4261feea14a63e2dac68cb7bc1c4c0c1ef517a14f6a02873c9

  • C:\Users\Admin\AppData\Local\Temp\77F.exe

    MD5

    0a465be9c75469e6f2398b2668a2c5f2

    SHA1

    9b610498a08345fe3280b6c79ed4b5d1945d6a79

    SHA256

    eca0040a928bb7f215b2379bf40b65397d4ead565ab8ad9a19c61740228e9f33

    SHA512

    eaa28aafc65e1d847f292e9e43279913b737bfb6649758548df11ebbb3de7c8c6c8e0568091b7f4261feea14a63e2dac68cb7bc1c4c0c1ef517a14f6a02873c9

  • C:\Users\Admin\AppData\Local\Temp\CFC.exe

    MD5

    80950391f894f81ef75eaecbd50747f4

    SHA1

    01488b302cd42243826f8f34d147071a73f39061

    SHA256

    cc5a84ba775fa7d79b15b3903899aca266f179bd4d630b4bd8c47d5fec08bd89

    SHA512

    22a6b41acd437088b006f959dc29a95be6965d0ca7eda9184227c03b9a9581e27df436620642474150af4917f7a2ddf7eef8c795ef929c0b996e1348cf659f37

  • C:\Users\Admin\AppData\Local\Temp\okgouu.exe

    MD5

    ac2ed87a0febfc631bb7a28bcb5fa017

    SHA1

    046da6715a7e1f1d262532d9027d31a38562149e

    SHA256

    194bcd7016f40d1dfe07de5f3e8b3f1e2c4428e70293fef0dae9cc23b45cc968

    SHA512

    a76f597fbcdf7aff19aef23f35005cf3625fec149dfe49a10d7733ddbd96ce4c8274db5714c60537bba9d0e3e4b4638707bafd147060ed3a6c0c357990fef9d7

  • C:\Users\Admin\AppData\Local\Temp\okgouu.exe

    MD5

    ac2ed87a0febfc631bb7a28bcb5fa017

    SHA1

    046da6715a7e1f1d262532d9027d31a38562149e

    SHA256

    194bcd7016f40d1dfe07de5f3e8b3f1e2c4428e70293fef0dae9cc23b45cc968

    SHA512

    a76f597fbcdf7aff19aef23f35005cf3625fec149dfe49a10d7733ddbd96ce4c8274db5714c60537bba9d0e3e4b4638707bafd147060ed3a6c0c357990fef9d7

  • C:\Users\Admin\AppData\Local\Temp\voxudocww.vbs

    MD5

    4b13abd262e6f452b680b7c404285a32

    SHA1

    a5b55774c48678a82ab377a7d23a00ec6a174dea

    SHA256

    e09b4b2ffbca61fbfaa017d9a6c7c60ec4242bfc468bf2f58887e79c97966eff

    SHA512

    8dc590452e549d1dbb582e6552e5cfe960adeb43987435b67d6d1f18d3ff44e7be01f638a7f62f7f47da561303fdc5203ca4412639662f170b6e0022e3ae6bc8

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    MD5

    1bcf7e6cc24b45c1b8c3c441fc0f0e64

    SHA1

    a70673aea1d53a29ce4da2e14b83095ff1a8327a

    SHA256

    dfb3defe9a50cfc629749cbcad4e281d216a06c186a84333aab68f68d5625e5e

    SHA512

    5896b4f14c65b89a3614018638c023166bb70bcaf3a1b41a01a3bb3881795eadb8577376ffd4a5648c8e3efbc00a371d7c440326cc8f5f83f9df2d9d566f1115

  • \Users\Admin\AppData\Local\Temp\77F.exe

    MD5

    0a465be9c75469e6f2398b2668a2c5f2

    SHA1

    9b610498a08345fe3280b6c79ed4b5d1945d6a79

    SHA256

    eca0040a928bb7f215b2379bf40b65397d4ead565ab8ad9a19c61740228e9f33

    SHA512

    eaa28aafc65e1d847f292e9e43279913b737bfb6649758548df11ebbb3de7c8c6c8e0568091b7f4261feea14a63e2dac68cb7bc1c4c0c1ef517a14f6a02873c9

  • \Users\Admin\AppData\Local\Temp\okgouu.exe

    MD5

    ac2ed87a0febfc631bb7a28bcb5fa017

    SHA1

    046da6715a7e1f1d262532d9027d31a38562149e

    SHA256

    194bcd7016f40d1dfe07de5f3e8b3f1e2c4428e70293fef0dae9cc23b45cc968

    SHA512

    a76f597fbcdf7aff19aef23f35005cf3625fec149dfe49a10d7733ddbd96ce4c8274db5714c60537bba9d0e3e4b4638707bafd147060ed3a6c0c357990fef9d7

  • memory/560-102-0x0000000002634000-0x0000000002637000-memory.dmp

    Filesize

    12KB

  • memory/560-91-0x0000000000000000-mapping.dmp

  • memory/560-92-0x000007FEFBB51000-0x000007FEFBB53000-memory.dmp

    Filesize

    8KB

  • memory/560-93-0x000007FEEB510000-0x000007FEEC06D000-memory.dmp

    Filesize

    11.4MB

  • memory/560-103-0x000000000263B000-0x000000000265A000-memory.dmp

    Filesize

    124KB

  • memory/560-83-0x0000000000400000-0x0000000002BD0000-memory.dmp

    Filesize

    39.8MB

  • memory/560-100-0x0000000002632000-0x0000000002634000-memory.dmp

    Filesize

    8KB

  • memory/560-99-0x0000000002630000-0x0000000002632000-memory.dmp

    Filesize

    8KB

  • memory/560-82-0x0000000000220000-0x00000000002B0000-memory.dmp

    Filesize

    576KB

  • memory/560-78-0x0000000000000000-mapping.dmp

  • memory/760-118-0x000000001B720000-0x000000001BA1F000-memory.dmp

    Filesize

    3.0MB

  • memory/760-113-0x0000000000000000-mapping.dmp

  • memory/760-121-0x000000000267B000-0x000000000269A000-memory.dmp

    Filesize

    124KB

  • memory/760-119-0x0000000002672000-0x0000000002674000-memory.dmp

    Filesize

    8KB

  • memory/760-120-0x0000000002674000-0x0000000002677000-memory.dmp

    Filesize

    12KB

  • memory/760-117-0x0000000002670000-0x0000000002672000-memory.dmp

    Filesize

    8KB

  • memory/760-116-0x000007FEEB510000-0x000007FEEC06D000-memory.dmp

    Filesize

    11.4MB

  • memory/812-110-0x0000000000000000-mapping.dmp

  • memory/952-85-0x000000001B8D0000-0x000000001B8D2000-memory.dmp

    Filesize

    8KB

  • memory/952-84-0x000000001ACA0000-0x000000001AD23000-memory.dmp

    Filesize

    524KB

  • memory/952-88-0x000000001ABD0000-0x000000001AC1F000-memory.dmp

    Filesize

    316KB

  • memory/952-89-0x000000001B810000-0x000000001B856000-memory.dmp

    Filesize

    280KB

  • memory/952-90-0x000000001B8D6000-0x000000001B8F5000-memory.dmp

    Filesize

    124KB

  • memory/952-86-0x0000000002270000-0x00000000022BE000-memory.dmp

    Filesize

    312KB

  • memory/952-87-0x0000000000770000-0x0000000000775000-memory.dmp

    Filesize

    20KB

  • memory/952-65-0x000000013FA30000-0x000000013FA31000-memory.dmp

    Filesize

    4KB

  • memory/952-62-0x0000000000000000-mapping.dmp

  • memory/1120-55-0x0000000000402FA5-mapping.dmp

  • memory/1120-56-0x0000000076201000-0x0000000076203000-memory.dmp

    Filesize

    8KB

  • memory/1120-54-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/1200-74-0x0000000000000000-mapping.dmp

  • memory/1200-80-0x0000000000050000-0x0000000000536000-memory.dmp

    Filesize

    4.9MB

  • memory/1424-57-0x0000000000020000-0x0000000000029000-memory.dmp

    Filesize

    36KB

  • memory/1428-58-0x00000000025D0000-0x00000000025E6000-memory.dmp

    Filesize

    88KB

  • memory/1636-71-0x00000000049F2000-0x00000000049F3000-memory.dmp

    Filesize

    4KB

  • memory/1636-70-0x00000000049F1000-0x00000000049F2000-memory.dmp

    Filesize

    4KB

  • memory/1636-77-0x00000000049F4000-0x00000000049F6000-memory.dmp

    Filesize

    8KB

  • memory/1636-73-0x0000000004A30000-0x0000000004A4E000-memory.dmp

    Filesize

    120KB

  • memory/1636-69-0x0000000000400000-0x0000000002BA3000-memory.dmp

    Filesize

    39.6MB

  • memory/1636-68-0x00000000001B0000-0x00000000001E0000-memory.dmp

    Filesize

    192KB

  • memory/1636-67-0x0000000002F70000-0x0000000002F8F000-memory.dmp

    Filesize

    124KB

  • memory/1636-59-0x0000000000000000-mapping.dmp

  • memory/1636-72-0x00000000049F3000-0x00000000049F4000-memory.dmp

    Filesize

    4KB

  • memory/1696-104-0x000000001AB30000-0x000000001ABB4000-memory.dmp

    Filesize

    528KB

  • memory/1696-98-0x000000013FE20000-0x000000013FE21000-memory.dmp

    Filesize

    4KB

  • memory/1696-106-0x0000000002110000-0x000000000215E000-memory.dmp

    Filesize

    312KB

  • memory/1696-96-0x0000000000000000-mapping.dmp

  • memory/1696-105-0x000000001BA20000-0x000000001BA22000-memory.dmp

    Filesize

    8KB