General

  • Target

    11ba4d8cf0672a4fb26246153bace4d6.exe

  • Size

    146KB

  • Sample

    210926-l2v7lseehm

  • MD5

    11ba4d8cf0672a4fb26246153bace4d6

  • SHA1

    50f558886a3ffac0f398a2d65a6e4b1ae199d655

  • SHA256

    e539faa062b0aefbf32f84e2b757fc1e40b2f53eb1aad7fdf942e5b594e63915

  • SHA512

    04dbdd9606d43726bbe0a5e3b48e07cfb59c5085eb9a4da1bfcd599045b8917b2637ab8ae389550b8489c3e383b38972c6a3eb603df5a72e93fc62cdc3d545e8

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes
  • url4cnc

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Targets

    • Target

      11ba4d8cf0672a4fb26246153bace4d6.exe

    • Size

      146KB

    • MD5

      11ba4d8cf0672a4fb26246153bace4d6

    • SHA1

      50f558886a3ffac0f398a2d65a6e4b1ae199d655

    • SHA256

      e539faa062b0aefbf32f84e2b757fc1e40b2f53eb1aad7fdf942e5b594e63915

    • SHA512

      04dbdd9606d43726bbe0a5e3b48e07cfb59c5085eb9a4da1bfcd599045b8917b2637ab8ae389550b8489c3e383b38972c6a3eb603df5a72e93fc62cdc3d545e8

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)

      suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)

    • suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

      suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

3
T1005

Tasks