Overview

overview

10

Static

static

c8c2f5565b...24.exe

windows7_x64

10

c8c2f5565b...24.exe

windows7_x64

10

c8c2f5565b...24.exe

windows7_x64

10

c8c2f5565b...24.exe

windows11_x64

10

c8c2f5565b...24.exe

windows10_x64

10

c8c2f5565b...24.exe

windows10_x64

10

c8c2f5565b...24.exe

windows10_x64

10

c8c2f5565b...24.exe

windows10_x64

10

Resubmissions

26-09-2021 14:45

210926-r4qb2aehcm 10

26-09-2021 14:41

210926-r2wq2afaa9 10

Analysis

  • max time kernel
    601s
  • max time network
    600s
  • platform
    windows7_x64
  • resource
    win7-ja-20210920
  • submitted
    26-09-2021 14:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c8c2f5565b13fbb60b89d11b7e71a03666c3afb2246b87e633cac8023bec0b24.exe

  • Size

    139KB

  • MD5

    3e201fc20a90e669990e2994d2114b83

  • SHA1

    24bfc9636c793e7ceb309b08e319b2d925a080bd

  • SHA256

    c8c2f5565b13fbb60b89d11b7e71a03666c3afb2246b87e633cac8023bec0b24

  • SHA512

    4dae9203c1003ca32600d153d7a9f08fa3c50d7c665ee81d4d7608d8f47354e48493d4bb39af2a3259c7882ca0ba38f4db52033b0df3ddf4321cb7118b228591

Score
10/10
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blissinstallszxckarmaz0rm1onbuildbackdoorbotnetdiscoveryevasioninfostealerspywarestealerthemidatrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

z0rm1onbuild

C2

45.156.21.209:56326

Extracted

Family

redline

Botnet

installszxc

C2

138.124.186.2:27999

Extracted

Family

raccoon

Botnet

b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7

Attributes
  • url4cnc

    https://t.me/hcdrom1

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes
  • url4cnc

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

Bliss

C2

185.237.98.178:62607

Extracted

Family

redline

Botnet

karma

C2

94.103.9.133:39323

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei
  • Generic Chinese Botnet

    A botnet originating from China which is currently unnamed publicly.

    botnetchinese_generic_botnet
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 8 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Arkei Stealer Payload 1 IoCs
    stealer
  • Chinese Botnet Payload 1 IoCs
    botnet
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Downloads MZ/PE file
  • Executes dropped EXE 18 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 49 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c8c2f5565b13fbb60b89d11b7e71a03666c3afb2246b87e633cac8023bec0b24.exe
    "C:\Users\Admin\AppData\Local\Temp\c8c2f5565b13fbb60b89d11b7e71a03666c3afb2246b87e633cac8023bec0b24.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1512
    • C:\Users\Admin\AppData\Local\Temp\c8c2f5565b13fbb60b89d11b7e71a03666c3afb2246b87e633cac8023bec0b24.exe
      "C:\Users\Admin\AppData\Local\Temp\c8c2f5565b13fbb60b89d11b7e71a03666c3afb2246b87e633cac8023bec0b24.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:308
  • C:\Users\Admin\AppData\Local\Temp\B079.exe
    C:\Users\Admin\AppData\Local\Temp\B079.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:700
    • C:\Users\Admin\AppData\Local\Temp\B079.exe
      C:\Users\Admin\AppData\Local\Temp\B079.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:568
  • C:\Users\Admin\AppData\Local\Temp\BA98.exe
    C:\Users\Admin\AppData\Local\Temp\BA98.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:1028
  • C:\Users\Admin\AppData\Local\Temp\C64C.exe
    C:\Users\Admin\AppData\Local\Temp\C64C.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\ProgramData\Stub.exe
      "C:\ProgramData\Stub.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:560
  • C:\Users\Admin\AppData\Local\Temp\CA82.exe
    C:\Users\Admin\AppData\Local\Temp\CA82.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1280
  • C:\Users\Admin\AppData\Local\Temp\E2D3.exe
    C:\Users\Admin\AppData\Local\Temp\E2D3.exe
    1⤵
    • Executes dropped EXE
    PID:1584
  • C:\Users\Admin\AppData\Local\Temp\ED11.exe
    C:\Users\Admin\AppData\Local\Temp\ED11.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:1236
  • C:\Users\Admin\AppData\Local\Temp\F2EC.exe
    C:\Users\Admin\AppData\Local\Temp\F2EC.exe
    1⤵
    • Executes dropped EXE
    PID:2016
  • C:\Users\Admin\AppData\Local\Temp\F82A.exe
    C:\Users\Admin\AppData\Local\Temp\F82A.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:664
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\F82A.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2120
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • Delays execution with timeout.exe
        PID:2164
  • C:\Users\Admin\AppData\Local\Temp\FCCD.exe
    C:\Users\Admin\AppData\Local\Temp\FCCD.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1788
    • C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe
      "C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2400
    • C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe
      "C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2424
    • C:\Users\Admin\AppData\Local\Temp\fbf.exe
      "C:\Users\Admin\AppData\Local\Temp\fbf.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious use of SetWindowsHookEx
      PID:2456
  • C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe
    "C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:2128
    • C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe
      "C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe" Win7
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:2208
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {E07D6201-AC8C-47C0-B31E-0015707E38DA} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
    1⤵
      PID:2268
      • C:\Users\Admin\AppData\Roaming\bdcdjiu
        C:\Users\Admin\AppData\Roaming\bdcdjiu
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:2076
        • C:\Users\Admin\AppData\Roaming\bdcdjiu
          C:\Users\Admin\AppData\Roaming\bdcdjiu
          3⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious behavior: MapViewOfSection
          PID:2088
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {F5BDEE12-C2AA-450F-B733-2A07E551AD9D} S-1-5-18:NT AUTHORITY\System:Service:
      1⤵
        PID:2116
      • C:\Windows\system32\taskeng.exe
        taskeng.exe {4D3022B0-0762-4BFE-80BB-44AD42EE660B} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
        1⤵
          PID:2420
          • C:\Program Files\Mozilla Firefox\default-browser-agent.exe
            "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
            2⤵
              PID:1316

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/308-53-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

            Download

          • memory/308-55-0x0000000074E31000-0x0000000074E33000-memory.dmp

            Filesize

            8KB

            Download

          • memory/560-95-0x00000000049B0000-0x00000000049B1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/560-91-0x0000000000D20000-0x0000000000D21000-memory.dmp

            Filesize

            4KB

            Download

          • memory/664-117-0x0000000000400000-0x000000000044D000-memory.dmp

            Filesize

            308KB

            Download

          • memory/664-116-0x0000000001BB0000-0x0000000001BDD000-memory.dmp

            Filesize

            180KB

            Download

          • memory/1028-83-0x0000000005170000-0x0000000005171000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1028-73-0x00000000008A0000-0x00000000008A1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1236-112-0x00000000052B0000-0x00000000052B1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1236-108-0x00000000002B0000-0x00000000002B1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1280-86-0x0000000000270000-0x000000000028E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/1280-81-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1280-84-0x000000001AFF0000-0x000000001AFF2000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1280-129-0x000000001AFF6000-0x000000001B015000-memory.dmp

            Filesize

            124KB

            Download

          • memory/1364-85-0x0000000003A90000-0x0000000003AA6000-memory.dmp

            Filesize

            88KB

            Download

          • memory/1364-57-0x0000000002930000-0x0000000002946000-memory.dmp

            Filesize

            88KB

            Download

          • memory/1364-182-0x00000000029F0000-0x0000000002A06000-memory.dmp

            Filesize

            88KB

            Download

          • memory/1512-56-0x0000000000220000-0x0000000000229000-memory.dmp

            Filesize

            36KB

            Download

          • memory/1520-82-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1520-74-0x0000000000C20000-0x0000000000C21000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1584-103-0x00000000002B0000-0x0000000000A43000-memory.dmp

            Filesize

            7.6MB

            Download

          • memory/1584-101-0x00000000001B0000-0x00000000001B1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1584-102-0x00000000001C0000-0x00000000001C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1584-99-0x0000000000110000-0x0000000000111000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1584-97-0x00000000000F0000-0x00000000000F1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1584-98-0x0000000000100000-0x0000000000101000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1584-100-0x0000000000120000-0x0000000000121000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1788-121-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2016-126-0x0000000000400000-0x00000000004F1000-memory.dmp

            Filesize

            964KB

            Download

          • memory/2016-125-0x0000000000320000-0x00000000003B0000-memory.dmp

            Filesize

            576KB

            Download

          • memory/2400-147-0x0000000002320000-0x000000000233E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/2400-156-0x0000000000230000-0x0000000000260000-memory.dmp

            Filesize

            192KB

            Download

          • memory/2400-158-0x0000000004871000-0x0000000004872000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2400-157-0x0000000000400000-0x00000000004C5000-memory.dmp

            Filesize

            788KB

            Download

          • memory/2400-146-0x0000000001FB0000-0x0000000001FCF000-memory.dmp

            Filesize

            124KB

            Download

          • memory/2400-159-0x0000000004872000-0x0000000004873000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2400-160-0x0000000004873000-0x0000000004874000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2400-161-0x0000000004874000-0x0000000004876000-memory.dmp

            Filesize

            8KB

            Download

          • memory/2424-153-0x00000000026A2000-0x00000000026A3000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2424-155-0x00000000026A4000-0x00000000026A6000-memory.dmp

            Filesize

            8KB

            Download

          • memory/2424-150-0x0000000000400000-0x00000000004CB000-memory.dmp

            Filesize

            812KB

            Download

          • memory/2424-149-0x0000000000230000-0x0000000000267000-memory.dmp

            Filesize

            220KB

            Download

          • memory/2424-151-0x00000000026A1000-0x00000000026A2000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2424-144-0x0000000002640000-0x0000000002662000-memory.dmp

            Filesize

            136KB

            Download

          • memory/2424-143-0x0000000001F80000-0x0000000001FA3000-memory.dmp

            Filesize

            140KB

            Download

          • memory/2424-154-0x00000000026A3000-0x00000000026A4000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2456-162-0x0000000010000000-0x0000000010018000-memory.dmp

            Filesize

            96KB

            Download

          • memory/2456-142-0x0000000000400000-0x00000000004C4000-memory.dmp

            Filesize

            784KB

            Download

          • memory/2456-141-0x0000000001C70000-0x0000000001D2C000-memory.dmp

            Filesize

            752KB

            Download