Overview

overview

10

Static

static

c8c2f5565b...24.exe

windows7_x64

10

c8c2f5565b...24.exe

windows7_x64

10

c8c2f5565b...24.exe

windows7_x64

10

c8c2f5565b...24.exe

windows11_x64

10

c8c2f5565b...24.exe

windows10_x64

10

c8c2f5565b...24.exe

windows10_x64

10

c8c2f5565b...24.exe

windows10_x64

10

c8c2f5565b...24.exe

windows10_x64

10

Resubmissions

26-09-2021 14:45

210926-r4qb2aehcm 10

26-09-2021 14:41

210926-r2wq2afaa9 10

Analysis

  • max time kernel
    603s
  • max time network
    629s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    26-09-2021 14:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c8c2f5565b13fbb60b89d11b7e71a03666c3afb2246b87e633cac8023bec0b24.exe

  • Size

    139KB

  • MD5

    3e201fc20a90e669990e2994d2114b83

  • SHA1

    24bfc9636c793e7ceb309b08e319b2d925a080bd

  • SHA256

    c8c2f5565b13fbb60b89d11b7e71a03666c3afb2246b87e633cac8023bec0b24

  • SHA512

    4dae9203c1003ca32600d153d7a9f08fa3c50d7c665ee81d4d7608d8f47354e48493d4bb39af2a3259c7882ca0ba38f4db52033b0df3ddf4321cb7118b228591

Score
10/10
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blissinstallszxckarmaz0rm1onbuildbackdoorbotnetdiscoveryevasioninfostealerspywarestealersuricatathemidatrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

z0rm1onbuild

C2

45.156.21.209:56326

Extracted

Family

redline

Botnet

installszxc

C2

138.124.186.2:27999

Extracted

Family

raccoon

Botnet

b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7

Attributes
  • url4cnc

    https://t.me/hcdrom1

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes
  • url4cnc

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

Bliss

C2

185.237.98.178:62607

Extracted

Family

redline

Botnet

karma

C2

94.103.9.133:39323

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei
  • Generic Chinese Botnet

    A botnet originating from China which is currently unnamed publicly.

    botnetchinese_generic_botnet
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 8 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata
  • Arkei Stealer Payload 1 IoCs
    stealer
  • Chinese Botnet Payload 1 IoCs
    botnet
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Downloads MZ/PE file
  • Executes dropped EXE 18 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 49 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c8c2f5565b13fbb60b89d11b7e71a03666c3afb2246b87e633cac8023bec0b24.exe
    "C:\Users\Admin\AppData\Local\Temp\c8c2f5565b13fbb60b89d11b7e71a03666c3afb2246b87e633cac8023bec0b24.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Users\Admin\AppData\Local\Temp\c8c2f5565b13fbb60b89d11b7e71a03666c3afb2246b87e633cac8023bec0b24.exe
      "C:\Users\Admin\AppData\Local\Temp\c8c2f5565b13fbb60b89d11b7e71a03666c3afb2246b87e633cac8023bec0b24.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1516
  • C:\Users\Admin\AppData\Local\Temp\697B.exe
    C:\Users\Admin\AppData\Local\Temp\697B.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:992
    • C:\Users\Admin\AppData\Local\Temp\697B.exe
      C:\Users\Admin\AppData\Local\Temp\697B.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:932
  • C:\Users\Admin\AppData\Local\Temp\7677.exe
    C:\Users\Admin\AppData\Local\Temp\7677.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:808
  • C:\Users\Admin\AppData\Local\Temp\7FAC.exe
    C:\Users\Admin\AppData\Local\Temp\7FAC.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1920
    • C:\ProgramData\Stub.exe
      "C:\ProgramData\Stub.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1880
  • C:\Users\Admin\AppData\Local\Temp\8384.exe
    C:\Users\Admin\AppData\Local\Temp\8384.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:832
  • C:\Users\Admin\AppData\Local\Temp\9C61.exe
    C:\Users\Admin\AppData\Local\Temp\9C61.exe
    1⤵
    • Executes dropped EXE
    PID:744
  • C:\Users\Admin\AppData\Local\Temp\A3F1.exe
    C:\Users\Admin\AppData\Local\Temp\A3F1.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:1348
  • C:\Users\Admin\AppData\Local\Temp\A8B3.exe
    C:\Users\Admin\AppData\Local\Temp\A8B3.exe
    1⤵
    • Executes dropped EXE
    PID:1500
  • C:\Users\Admin\AppData\Local\Temp\AE20.exe
    C:\Users\Admin\AppData\Local\Temp\AE20.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\AE20.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2080
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • Delays execution with timeout.exe
        PID:2120
  • C:\Users\Admin\AppData\Local\Temp\B330.exe
    C:\Users\Admin\AppData\Local\Temp\B330.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe
      "C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2252
    • C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe
      "C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2268
    • C:\Users\Admin\AppData\Local\Temp\fbf.exe
      "C:\Users\Admin\AppData\Local\Temp\fbf.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious use of SetWindowsHookEx
      PID:2316
  • C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe
    "C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:2964
    • C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe
      "C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe" Win7
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:3060
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {E150EAEC-4BF2-4E6B-A51C-081A6694328A} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]
    1⤵
      PID:2288
      • C:\Users\Admin\AppData\Roaming\ubregrr
        C:\Users\Admin\AppData\Roaming\ubregrr
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:2360
        • C:\Users\Admin\AppData\Roaming\ubregrr
          C:\Users\Admin\AppData\Roaming\ubregrr
          3⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious behavior: MapViewOfSection
          PID:268

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/744-109-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB

      Download

    • memory/744-107-0x0000000000120000-0x0000000000121000-memory.dmp

      Filesize

      4KB

      Download

    • memory/744-108-0x0000000000130000-0x0000000000131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/744-106-0x0000000000110000-0x0000000000111000-memory.dmp

      Filesize

      4KB

      Download

    • memory/744-110-0x0000000000960000-0x00000000010F3000-memory.dmp

      Filesize

      7.6MB

      Download

    • memory/744-105-0x0000000000100000-0x0000000000101000-memory.dmp

      Filesize

      4KB

      Download

    • memory/744-104-0x00000000000F0000-0x00000000000F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/808-78-0x00000000008F0000-0x00000000008F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/808-85-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/832-90-0x0000000000B00000-0x0000000000B01000-memory.dmp

      Filesize

      4KB

      Download

    • memory/832-133-0x000000001AFF6000-0x000000001B015000-memory.dmp

      Filesize

      124KB

      Download

    • memory/832-91-0x000000001AFF0000-0x000000001AFF2000-memory.dmp

      Filesize

      8KB

      Download

    • memory/832-93-0x0000000000490000-0x00000000004AE000-memory.dmp

      Filesize

      120KB

      Download

    • memory/1212-65-0x0000000002B30000-0x0000000002B40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1212-191-0x0000000002B90000-0x0000000002BA6000-memory.dmp

      Filesize

      88KB

      Download

    • memory/1212-64-0x0000000002AE0000-0x0000000002AF6000-memory.dmp

      Filesize

      88KB

      Download

    • memory/1212-92-0x0000000003D20000-0x0000000003D36000-memory.dmp

      Filesize

      88KB

      Download

    • memory/1212-173-0x000007FEEA250000-0x000007FEEA393000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/1212-174-0x000007FF031E0000-0x000007FF031EA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1348-115-0x0000000000B00000-0x0000000000B01000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1348-117-0x00000000051E0000-0x00000000051E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1500-126-0x0000000000220000-0x00000000002B0000-memory.dmp

      Filesize

      576KB

      Download

    • memory/1500-127-0x0000000000400000-0x00000000004F1000-memory.dmp

      Filesize

      964KB

      Download

    • memory/1516-60-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

      Download

    • memory/1516-62-0x0000000075801000-0x0000000075803000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1724-131-0x00000000000D0000-0x00000000000D1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1824-63-0x0000000000230000-0x0000000000239000-memory.dmp

      Filesize

      36KB

      Download

    • memory/1880-100-0x0000000004920000-0x0000000004921000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1880-98-0x0000000000B40000-0x0000000000B41000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1884-125-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/1884-124-0x0000000000700000-0x000000000072D000-memory.dmp

      Filesize

      180KB

      Download

    • memory/1920-86-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1920-83-0x0000000000930000-0x0000000000931000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2252-163-0x00000000047E1000-0x00000000047E2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2252-157-0x00000000005A0000-0x00000000005BF000-memory.dmp

      Filesize

      124KB

      Download

    • memory/2252-160-0x00000000001C0000-0x00000000001F0000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2252-162-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

      Download

    • memory/2252-158-0x0000000000680000-0x000000000069E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/2252-164-0x00000000047E2000-0x00000000047E3000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2252-165-0x00000000047E3000-0x00000000047E4000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2252-166-0x00000000047E4000-0x00000000047E6000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2268-154-0x00000000048E1000-0x00000000048E2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2268-149-0x0000000002390000-0x00000000023B3000-memory.dmp

      Filesize

      140KB

      Download

    • memory/2268-152-0x00000000023C0000-0x00000000023E2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/2268-155-0x00000000048E4000-0x00000000048E6000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2268-151-0x00000000048E2000-0x00000000048E3000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2268-153-0x00000000048E3000-0x00000000048E4000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2268-150-0x0000000000400000-0x00000000004CB000-memory.dmp

      Filesize

      812KB

      Download

    • memory/2268-148-0x0000000000230000-0x0000000000267000-memory.dmp

      Filesize

      220KB

      Download

    • memory/2316-169-0x0000000010000000-0x0000000010018000-memory.dmp

      Filesize

      96KB

      Download

    • memory/2316-161-0x0000000000340000-0x00000000003FC000-memory.dmp

      Filesize

      752KB

      Download

    • memory/2316-167-0x0000000000400000-0x00000000004C4000-memory.dmp

      Filesize

      784KB

      Download