Analysis

  • max time kernel
    153s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    26-09-2021 11:06

General

  • Target

    536a5923e7d715d78d0280c4f029a689.exe

  • Size

    145KB

  • MD5

    536a5923e7d715d78d0280c4f029a689

  • SHA1

    bd9f2d517c083e5be0132d72edffa7ebb10834e2

  • SHA256

    64cb3ce12c5cdfdf4e0dd3e9f0bcd9e43745ee83c3289a27c73f6c6f4243049c

  • SHA512

    e37ca66546f6104df783134a6e3076af3f2dfc8f720777efab35c9c96ddb118fabda4c52de18623cfd3a88c64769ba07957d58b47f44fa62ed65e4b1d6cb1f4a

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

qq

C2

135.181.142.223:30397

Extracted

Family

redline

Botnet

installszxc

C2

138.124.186.2:27999

Extracted

Family

raccoon

Botnet

d4d8e30c16491ca1c11f7aa675764335342faedf

Attributes
  • url4cnc

    https://t.me/hcdrom1

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes
  • url4cnc

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 9 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\536a5923e7d715d78d0280c4f029a689.exe
    "C:\Users\Admin\AppData\Local\Temp\536a5923e7d715d78d0280c4f029a689.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1840
    • C:\Users\Admin\AppData\Local\Temp\536a5923e7d715d78d0280c4f029a689.exe
      "C:\Users\Admin\AppData\Local\Temp\536a5923e7d715d78d0280c4f029a689.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1608
  • C:\Users\Admin\AppData\Local\Temp\F047.exe
    C:\Users\Admin\AppData\Local\Temp\F047.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1332
    • C:\Users\Admin\AppData\Local\Temp\F047.exe
      C:\Users\Admin\AppData\Local\Temp\F047.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1984
  • C:\Users\Admin\AppData\Local\Temp\F373.exe
    C:\Users\Admin\AppData\Local\Temp\F373.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\Users\Admin\AppData\Local\Temp\F373.exe
      C:\Users\Admin\AppData\Local\Temp\F373.exe
      2⤵
      • Executes dropped EXE
      PID:544
  • C:\Users\Admin\AppData\Local\Temp\F9BB.exe
    C:\Users\Admin\AppData\Local\Temp\F9BB.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:268
  • C:\Users\Admin\AppData\Local\Temp\33D.exe
    C:\Users\Admin\AppData\Local\Temp\33D.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:360
    • C:\ProgramData\Stub.exe
      "C:\ProgramData\Stub.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:744
  • C:\Users\Admin\AppData\Local\Temp\E36.exe
    C:\Users\Admin\AppData\Local\Temp\E36.exe
    1⤵
    • Executes dropped EXE
    PID:1656
  • C:\Users\Admin\AppData\Local\Temp\13E2.exe
    C:\Users\Admin\AppData\Local\Temp\13E2.exe
    1⤵
    • Executes dropped EXE
    PID:932

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Stub.exe
    MD5

    d04d4d9896a08dc0ec357ca574814a1b

    SHA1

    c505429beddc51abc26c29e5ee96df5f44a8f171

    SHA256

    dff7a52513235d80ee44e0a38c1b9078787d0482af66646b4a84c43bc539e2b3

    SHA512

    7cc60ebe0ce9966247868fa679076cc9258bcaf2f3b036249143c6d2eac41ef6d3396503b6434173b41cc6dc393b6cf58ed8919f3d8bcc5c44a03a59c0aa4cc0

  • C:\ProgramData\Stub.exe
    MD5

    d04d4d9896a08dc0ec357ca574814a1b

    SHA1

    c505429beddc51abc26c29e5ee96df5f44a8f171

    SHA256

    dff7a52513235d80ee44e0a38c1b9078787d0482af66646b4a84c43bc539e2b3

    SHA512

    7cc60ebe0ce9966247868fa679076cc9258bcaf2f3b036249143c6d2eac41ef6d3396503b6434173b41cc6dc393b6cf58ed8919f3d8bcc5c44a03a59c0aa4cc0

  • C:\Users\Admin\AppData\Local\Temp\13E2.exe
    MD5

    c370776d145e3a91f1508f19b4aa91ad

    SHA1

    5a0466bbe35891a714bd990416c161bc043bf1ee

    SHA256

    1d18e2a2ea46326d627c723fba8bb49b0771fce9d3702c297df881a7014e355e

    SHA512

    ac3ddde1c683e50f8a27f22cf79b60a71462296a3fce70f64acfbf9cd219e96cf2d957db94bdd60def6fc80a9f6300802d16171224fdff11f316bd536eb68252

  • C:\Users\Admin\AppData\Local\Temp\33D.exe
    MD5

    f565831d19adf8e031e0eacccd65d339

    SHA1

    a20c300ac91be8f9f3497d11144ed511a31b7962

    SHA256

    6d4aeb893fda30cf349de8af13358009206ea3c4d094e771a3bd777aa4bd4a30

    SHA512

    2c75feacccce0b996e1773803ae7aa96d8236752fd89d995beedb66f0a9fc2b79cbc20c1f7e7c4e2d0176a116dd660625d54d3ceead876cdc0ef1cf334bb719e

  • C:\Users\Admin\AppData\Local\Temp\33D.exe
    MD5

    f565831d19adf8e031e0eacccd65d339

    SHA1

    a20c300ac91be8f9f3497d11144ed511a31b7962

    SHA256

    6d4aeb893fda30cf349de8af13358009206ea3c4d094e771a3bd777aa4bd4a30

    SHA512

    2c75feacccce0b996e1773803ae7aa96d8236752fd89d995beedb66f0a9fc2b79cbc20c1f7e7c4e2d0176a116dd660625d54d3ceead876cdc0ef1cf334bb719e

  • C:\Users\Admin\AppData\Local\Temp\E36.exe
    MD5

    289b39476779b3e139cec7a4cb28fbf6

    SHA1

    ae74c4f2b6e02797a563cd715a4c0bbe198758bf

    SHA256

    7e177cac9c011e68822e22cb9368c8af537d84e040bf3e43eebe5a3ffa5f4e50

    SHA512

    14a0ec6c2d8679ed669c2e00f3d80f68ef7c243629d588ef9a83f949d83c7f53f6cbb51217b167575a58354f4d3ca04bc20398dc77122bd4812d562e7740cfe8

  • C:\Users\Admin\AppData\Local\Temp\F047.exe
    MD5

    af0cc60704aed2e286cdf83a5c803b88

    SHA1

    51eeedfbdbb922e555540ef67cb10848b9e10004

    SHA256

    92d3bcce6b0f038eeadea190ef6915090f843de525601fe4a61334cdab827bbf

    SHA512

    ae9bd11ec8ffdc0e9aa18a83b55e983482d4e3bf642a1ff6d7af8ab271e9e3930afb0dfa49d477d06f35dcbe72d4f7fcd725146b2b13a2c75af516607f79f93d

  • C:\Users\Admin\AppData\Local\Temp\F047.exe
    MD5

    af0cc60704aed2e286cdf83a5c803b88

    SHA1

    51eeedfbdbb922e555540ef67cb10848b9e10004

    SHA256

    92d3bcce6b0f038eeadea190ef6915090f843de525601fe4a61334cdab827bbf

    SHA512

    ae9bd11ec8ffdc0e9aa18a83b55e983482d4e3bf642a1ff6d7af8ab271e9e3930afb0dfa49d477d06f35dcbe72d4f7fcd725146b2b13a2c75af516607f79f93d

  • C:\Users\Admin\AppData\Local\Temp\F047.exe
    MD5

    af0cc60704aed2e286cdf83a5c803b88

    SHA1

    51eeedfbdbb922e555540ef67cb10848b9e10004

    SHA256

    92d3bcce6b0f038eeadea190ef6915090f843de525601fe4a61334cdab827bbf

    SHA512

    ae9bd11ec8ffdc0e9aa18a83b55e983482d4e3bf642a1ff6d7af8ab271e9e3930afb0dfa49d477d06f35dcbe72d4f7fcd725146b2b13a2c75af516607f79f93d

  • C:\Users\Admin\AppData\Local\Temp\F373.exe
    MD5

    8df6ef1e48d3a33226c91bf4a93b0c8a

    SHA1

    e70ed102babe577b9481be056cb8cc0564bdc669

    SHA256

    5c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd

    SHA512

    d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0

  • C:\Users\Admin\AppData\Local\Temp\F373.exe
    MD5

    8df6ef1e48d3a33226c91bf4a93b0c8a

    SHA1

    e70ed102babe577b9481be056cb8cc0564bdc669

    SHA256

    5c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd

    SHA512

    d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0

  • C:\Users\Admin\AppData\Local\Temp\F373.exe
    MD5

    8df6ef1e48d3a33226c91bf4a93b0c8a

    SHA1

    e70ed102babe577b9481be056cb8cc0564bdc669

    SHA256

    5c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd

    SHA512

    d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0

  • C:\Users\Admin\AppData\Local\Temp\F9BB.exe
    MD5

    f853fe6b26dcf67545675aec618f3a99

    SHA1

    a70f5ffd6dac789909ccb19dfb31272a520c7bc0

    SHA256

    091ba447af0f0cabd66484b3f81e909ca01be4e27db9ccf42779174e04dad57a

    SHA512

    4764e88d5bdcf88447e0782c88fec18f5a1083b460829e16635a8602173f1a6813d3ff93866bef587f9f9b682451d4386bd765b2da580c69f7483b48f074bbd3

  • \ProgramData\Stub.exe
    MD5

    d04d4d9896a08dc0ec357ca574814a1b

    SHA1

    c505429beddc51abc26c29e5ee96df5f44a8f171

    SHA256

    dff7a52513235d80ee44e0a38c1b9078787d0482af66646b4a84c43bc539e2b3

    SHA512

    7cc60ebe0ce9966247868fa679076cc9258bcaf2f3b036249143c6d2eac41ef6d3396503b6434173b41cc6dc393b6cf58ed8919f3d8bcc5c44a03a59c0aa4cc0

  • \Users\Admin\AppData\Local\Temp\F047.exe
    MD5

    af0cc60704aed2e286cdf83a5c803b88

    SHA1

    51eeedfbdbb922e555540ef67cb10848b9e10004

    SHA256

    92d3bcce6b0f038eeadea190ef6915090f843de525601fe4a61334cdab827bbf

    SHA512

    ae9bd11ec8ffdc0e9aa18a83b55e983482d4e3bf642a1ff6d7af8ab271e9e3930afb0dfa49d477d06f35dcbe72d4f7fcd725146b2b13a2c75af516607f79f93d

  • \Users\Admin\AppData\Local\Temp\F373.exe
    MD5

    8df6ef1e48d3a33226c91bf4a93b0c8a

    SHA1

    e70ed102babe577b9481be056cb8cc0564bdc669

    SHA256

    5c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd

    SHA512

    d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0

  • memory/268-84-0x0000000001330000-0x0000000001331000-memory.dmp
    Filesize

    4KB

  • memory/268-86-0x00000000051B0000-0x00000000051B1000-memory.dmp
    Filesize

    4KB

  • memory/268-78-0x0000000000000000-mapping.dmp
  • memory/360-87-0x0000000000000000-mapping.dmp
  • memory/360-90-0x0000000001380000-0x0000000001381000-memory.dmp
    Filesize

    4KB

  • memory/360-93-0x0000000004E30000-0x0000000004E31000-memory.dmp
    Filesize

    4KB

  • memory/544-95-0x000000000041C5CE-mapping.dmp
  • memory/544-94-0x0000000000400000-0x0000000000422000-memory.dmp
    Filesize

    136KB

  • memory/744-109-0x0000000002110000-0x0000000002111000-memory.dmp
    Filesize

    4KB

  • memory/744-106-0x0000000000220000-0x0000000000221000-memory.dmp
    Filesize

    4KB

  • memory/744-103-0x0000000000000000-mapping.dmp
  • memory/932-100-0x0000000000000000-mapping.dmp
  • memory/932-115-0x0000000000400000-0x00000000004F2000-memory.dmp
    Filesize

    968KB

  • memory/932-114-0x0000000000220000-0x00000000002B0000-memory.dmp
    Filesize

    576KB

  • memory/1208-67-0x0000000000000000-mapping.dmp
  • memory/1208-74-0x00000000020D0000-0x00000000020D1000-memory.dmp
    Filesize

    4KB

  • memory/1208-70-0x00000000003C0000-0x00000000003C1000-memory.dmp
    Filesize

    4KB

  • memory/1212-99-0x0000000003E10000-0x0000000003E26000-memory.dmp
    Filesize

    88KB

  • memory/1212-64-0x0000000004BE0000-0x0000000004BF6000-memory.dmp
    Filesize

    88KB

  • memory/1212-116-0x000007FEF4F10000-0x000007FEF5053000-memory.dmp
    Filesize

    1.3MB

  • memory/1212-112-0x00000000044D0000-0x00000000044E0000-memory.dmp
    Filesize

    64KB

  • memory/1212-117-0x000007FF04A40000-0x000007FF04A4A000-memory.dmp
    Filesize

    40KB

  • memory/1332-65-0x0000000000000000-mapping.dmp
  • memory/1608-62-0x0000000074D91000-0x0000000074D93000-memory.dmp
    Filesize

    8KB

  • memory/1608-60-0x0000000000400000-0x0000000000409000-memory.dmp
    Filesize

    36KB

  • memory/1608-61-0x0000000000402FA5-mapping.dmp
  • memory/1656-110-0x0000000000370000-0x0000000000400000-memory.dmp
    Filesize

    576KB

  • memory/1656-111-0x0000000000400000-0x00000000004F2000-memory.dmp
    Filesize

    968KB

  • memory/1656-97-0x0000000000000000-mapping.dmp
  • memory/1840-63-0x0000000000220000-0x0000000000229000-memory.dmp
    Filesize

    36KB

  • memory/1984-76-0x0000000000402FA5-mapping.dmp