Overview

overview

10

Static

static

3dd4ba94c5...68.exe

windows7_x64

10

3dd4ba94c5...68.exe

windows7_x64

10

3dd4ba94c5...68.exe

windows7_x64

10

3dd4ba94c5...68.exe

windows11_x64

10

3dd4ba94c5...68.exe

windows10_x64

10

3dd4ba94c5...68.exe

windows10_x64

10

3dd4ba94c5...68.exe

windows10_x64

10

3dd4ba94c5...68.exe

windows10_x64

10

Resubmissions

26-09-2021 14:45

210926-r43blaehcn 10

26-09-2021 14:26

210926-rrve8aehh8 10

Analysis

  • max time kernel
    1802s
  • max time network
    1838s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    26-09-2021 14:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3dd4ba94c558b54ba1fe639566cbc368.exe

  • Size

    237KB

  • MD5

    3dd4ba94c558b54ba1fe639566cbc368

  • SHA1

    8c44f1c918c3d2fd48694e8af653e473be3e02c1

  • SHA256

    c75b223b462ba88c62c1c8d848a845e7aeacc0ec0c96a7ecf1644e782accdd52

  • SHA512

    58e828507bd3be52ea340ed835c3dc06a655db0a067c746ef65e7382d2b09eb5e7d6847dc679b89539826b598749e60ddf62859e25930b8e586acc11228bb1fa

Score
10/10
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blissinstallszxckarmaz0rm1onbuildbackdoorbotnetdiscoveryevasioninfostealerspywarestealersuricatathemidatrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

installszxc

C2

138.124.186.2:27999

Extracted

Family

redline

Botnet

z0rm1onbuild

C2

45.156.21.209:56326

Extracted

Family

raccoon

Botnet

b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7

Attributes
  • url4cnc

    https://t.me/hcdrom1

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes
  • url4cnc

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

karma

C2

94.103.9.133:39323

Extracted

Family

redline

Botnet

Bliss

C2

185.237.98.178:62607

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei
  • Generic Chinese Botnet

    A botnet originating from China which is currently unnamed publicly.

    botnetchinese_generic_botnet
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 8 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata
  • Arkei Stealer Payload 1 IoCs
    stealer
  • Chinese Botnet Payload 1 IoCs
    botnet
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Downloads MZ/PE file
  • Executes dropped EXE 22 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 15 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 49 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe
    "C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe
      "C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2012
  • C:\Users\Admin\AppData\Local\Temp\6E9A.exe
    C:\Users\Admin\AppData\Local\Temp\6E9A.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Users\Admin\AppData\Local\Temp\6E9A.exe
      C:\Users\Admin\AppData\Local\Temp\6E9A.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1692
  • C:\Users\Admin\AppData\Local\Temp\7983.exe
    C:\Users\Admin\AppData\Local\Temp\7983.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:576
  • C:\Users\Admin\AppData\Local\Temp\82F6.exe
    C:\Users\Admin\AppData\Local\Temp\82F6.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\ProgramData\Stub.exe
      "C:\ProgramData\Stub.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1788
  • C:\Users\Admin\AppData\Local\Temp\8690.exe
    C:\Users\Admin\AppData\Local\Temp\8690.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:908
  • C:\Users\Admin\AppData\Local\Temp\987B.exe
    C:\Users\Admin\AppData\Local\Temp\987B.exe
    1⤵
    • Executes dropped EXE
    PID:2032
  • C:\Users\Admin\AppData\Local\Temp\A049.exe
    C:\Users\Admin\AppData\Local\Temp\A049.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:1900
  • C:\Users\Admin\AppData\Local\Temp\A5D5.exe
    C:\Users\Admin\AppData\Local\Temp\A5D5.exe
    1⤵
    • Executes dropped EXE
    PID:1664
  • C:\Users\Admin\AppData\Local\Temp\AB72.exe
    C:\Users\Admin\AppData\Local\Temp\AB72.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:560
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\AB72.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2132
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • Delays execution with timeout.exe
        PID:2168
  • C:\Users\Admin\AppData\Local\Temp\B3DB.exe
    C:\Users\Admin\AppData\Local\Temp\B3DB.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe
      "C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2268
    • C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe
      "C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2284
    • C:\Users\Admin\AppData\Local\Temp\fbf.exe
      "C:\Users\Admin\AppData\Local\Temp\fbf.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious use of SetWindowsHookEx
      PID:2328
  • C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe
    "C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:2880
    • C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe
      "C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe" Win7
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:2952
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {374A7E93-CE66-467B-9B5E-3A2B92085816} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]
    1⤵
      PID:1764
      • C:\Users\Admin\AppData\Roaming\atdafeu
        C:\Users\Admin\AppData\Roaming\atdafeu
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:792
        • C:\Users\Admin\AppData\Roaming\atdafeu
          C:\Users\Admin\AppData\Roaming\atdafeu
          3⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious behavior: MapViewOfSection
          PID:2060
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {27ADEEE1-189A-4F19-9DC6-4382928E6D1A} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]
      1⤵
        PID:2300
        • C:\Users\Admin\AppData\Roaming\atdafeu
          C:\Users\Admin\AppData\Roaming\atdafeu
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          PID:1364
          • C:\Users\Admin\AppData\Roaming\atdafeu
            C:\Users\Admin\AppData\Roaming\atdafeu
            3⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            • Suspicious behavior: MapViewOfSection
            PID:1656
      • C:\Windows\system32\taskeng.exe
        taskeng.exe {8456200E-5D85-4080-B77C-92FB6B892A5A} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]
        1⤵
          PID:2648
          • C:\Users\Admin\AppData\Roaming\atdafeu
            C:\Users\Admin\AppData\Roaming\atdafeu
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:2828
            • C:\Users\Admin\AppData\Roaming\atdafeu
              C:\Users\Admin\AppData\Roaming\atdafeu
              3⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              • Suspicious behavior: MapViewOfSection
              PID:2844

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/560-126-0x00000000006C0000-0x00000000006ED000-memory.dmp

          Filesize

          180KB

          Download

        • memory/560-128-0x0000000000400000-0x000000000044D000-memory.dmp

          Filesize

          308KB

          Download

        • memory/576-78-0x0000000000100000-0x0000000000101000-memory.dmp

          Filesize

          4KB

          Download

        • memory/576-80-0x0000000000E20000-0x0000000000E21000-memory.dmp

          Filesize

          4KB

          Download

        • memory/908-90-0x0000000000E30000-0x0000000000E31000-memory.dmp

          Filesize

          4KB

          Download

        • memory/908-91-0x000000001B060000-0x000000001B062000-memory.dmp

          Filesize

          8KB

          Download

        • memory/908-100-0x00000000003F0000-0x000000000040E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/908-123-0x000000001B066000-0x000000001B085000-memory.dmp

          Filesize

          124KB

          Download

        • memory/1220-189-0x0000000002980000-0x0000000002996000-memory.dmp

          Filesize

          88KB

          Download

        • memory/1220-92-0x0000000002BF0000-0x0000000002C06000-memory.dmp

          Filesize

          88KB

          Download

        • memory/1220-64-0x00000000025D0000-0x00000000025E6000-memory.dmp

          Filesize

          88KB

          Download

        • memory/1220-65-0x0000000002D30000-0x0000000002D40000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1220-203-0x00000000029D0000-0x00000000029E6000-memory.dmp

          Filesize

          88KB

          Download

        • memory/1220-196-0x00000000029B0000-0x00000000029C6000-memory.dmp

          Filesize

          88KB

          Download

        • memory/1588-84-0x0000000001340000-0x0000000001341000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1588-86-0x0000000001220000-0x0000000001221000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1664-127-0x0000000000400000-0x00000000004F1000-memory.dmp

          Filesize

          964KB

          Download

        • memory/1664-133-0x0000000000C10000-0x0000000000C11000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1664-125-0x00000000002C0000-0x0000000000350000-memory.dmp

          Filesize

          576KB

          Download

        • memory/1788-99-0x0000000004480000-0x0000000004481000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1788-97-0x0000000000F60000-0x0000000000F61000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1900-115-0x00000000010B0000-0x00000000010B1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1900-117-0x0000000002E50000-0x0000000002E51000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2012-62-0x00000000754F1000-0x00000000754F3000-memory.dmp

          Filesize

          8KB

          Download

        • memory/2012-60-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download

        • memory/2020-63-0x0000000000220000-0x0000000000229000-memory.dmp

          Filesize

          36KB

          Download

        • memory/2032-106-0x00000000000B0000-0x00000000000B1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2032-109-0x0000000000190000-0x0000000000191000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2032-110-0x0000000000D80000-0x0000000001513000-memory.dmp

          Filesize

          7.6MB

          Download

        • memory/2032-108-0x00000000000D0000-0x00000000000D1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2032-107-0x00000000000C0000-0x00000000000C1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2032-105-0x0000000000090000-0x0000000000091000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2032-104-0x0000000000080000-0x0000000000081000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2268-159-0x0000000000800000-0x000000000081E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2268-152-0x00000000047A1000-0x00000000047A2000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2268-168-0x00000000047A3000-0x00000000047A4000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2268-170-0x00000000047A4000-0x00000000047A6000-memory.dmp

          Filesize

          8KB

          Download

        • memory/2268-149-0x0000000000230000-0x0000000000260000-memory.dmp

          Filesize

          192KB

          Download

        • memory/2268-151-0x00000000003C0000-0x00000000003DF000-memory.dmp

          Filesize

          124KB

          Download

        • memory/2268-165-0x00000000047A2000-0x00000000047A3000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2268-155-0x0000000000400000-0x00000000004C5000-memory.dmp

          Filesize

          788KB

          Download

        • memory/2284-153-0x0000000000230000-0x0000000000267000-memory.dmp

          Filesize

          220KB

          Download

        • memory/2284-169-0x0000000004964000-0x0000000004966000-memory.dmp

          Filesize

          8KB

          Download

        • memory/2284-166-0x0000000004962000-0x0000000004963000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2284-158-0x00000000021A0000-0x00000000021C2000-memory.dmp

          Filesize

          136KB

          Download

        • memory/2284-156-0x0000000001DC0000-0x0000000001DE3000-memory.dmp

          Filesize

          140KB

          Download

        • memory/2284-167-0x0000000004963000-0x0000000004964000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2284-157-0x0000000004961000-0x0000000004962000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2284-154-0x0000000000400000-0x00000000004CB000-memory.dmp

          Filesize

          812KB

          Download

        • memory/2328-148-0x0000000001D00000-0x0000000001DBC000-memory.dmp

          Filesize

          752KB

          Download

        • memory/2328-150-0x0000000000400000-0x00000000004C4000-memory.dmp

          Filesize

          784KB

          Download

        • memory/2328-161-0x0000000010000000-0x0000000010018000-memory.dmp

          Filesize

          96KB

          Download